Repository navigation
Conversation
mwolson
force-pushed
the
contrib/bun-native-relative-tarball
branch
from
October 25, 2026 03:08
10aa8a9 to
dc7896a
Compare
mwolson
force-pushed
the
contrib/tarball-transitive-local-dep
branch
from
October 25, 2026 03:08
012d89c to
dd3405d
Compare
…e root Tarball parents have no directory source root. Permit their absolute local child paths, matching pnpm and npm, while retaining the exotic source policy and the guard for unanchored relative paths.
mwolson
force-pushed
the
contrib/tarball-transitive-local-dep
branch
from
October 25, 2026 17:27
dd3405d to
8f26f4f
Compare
mwolson
force-pushed
the
contrib/bun-native-relative-tarball
branch
from
October 25, 2026 17:27
dc7896a to
93aa663
Compare
jdx
added a commit
to aubepkg/aube
that referenced
this pull request
Oct 25, 2026
#1852) <!-- entire-trail-link-start --> https://entire.com/gh/aubepkg/-/trails/209/changes/aube/209 <!-- entire-trail-link-end --> A local tarball dependency whose manifest declares another local package by absolute path could not be installed, even with the exotic-subdependency block turned off: ```ini # .npmrc block-exotic-subdeps=false ``` ```json // host.tgz → package.json { "name": "host", "version": "1.0.0", "dependencies": { "child": "file:/abs/path/child.tgz" } } ``` **Before:** `aube install` failed with `transitive local specifier file:/abs/path/child.tgz cannot be resolved without the parent package source root`. A tarball parent has no source directory, and the guard demanded one for every path-backed child. **After:** absolute `file:`/`link:` children resolve without a parent source root (pnpm, npm and Bun accept the same layout). The exotic-source policy still runs first, so the default `block-exotic-subdeps=true` still blocks it, and relative paths with no anchor are still rejected, since package managers disagree on their base. Validation: new resolver unit tests cover directory and tarball absolute children, the default block, and relative-path rejection; `cargo test -p aube-resolver` passes; fmt and clippy clean for the touched crates. Not run: full bats suite. Reported in discussion #1830; patch adapted from mwolson#14. *AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.* 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Mike Olson <mwolson@member.fsf.org> Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Owner
Author
|
Absorbed upstream by aubepkg#1852 resolver-absolute-local-children (the frozen-install half stays in #4 pnpm-lock-rewrite-metadata) in the 2026-10-25 refresh onto upstream 9cafd04. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A local tarball dependency can declare another local package by absolute
file:path when exotic subdependencies are allowed.Problem and Fix
block-exotic-subdeps=false, a tarball parent's absolutefile:child failed withcannot be resolved without the parent package source root. The guard required a parent source directory for every path-backed child, and tarballs have none.Validation
tarball-transitive-local-deppasses; pnpm 12.14.0, npm 11.6.2 and Bun 1.4.3 accept the same fixture.