[Bug]: installing new packages invalidates caches for unrelated targets

[HunterLarco]

What happened?

I would expect when installing a new package via the npm_translate_lock + npm_link_all_packages that it would not invalidate any cache entries. However, I observe that pnpm add -E foo + aspect lint //... invalidates all targets despite none relying on //:node_modules/foo

Version

Development (host) and target OS/architectures:

Output of bazel --version:aspect 2025.19.5+06d8a1c78

Version of the Aspect rules, or other relevant rules from your
WORKSPACE or MODULE.bazel file:

bazel_dep(name = "aspect_bazel_lib", version = "2.19.2")
bazel_dep(name = "aspect_rules_rollup", version = "2.0.1")
bazel_dep(name = "aspect_rules_lint", version = "1.5.3")
bazel_dep(name = "rules_nodejs", version = "6.4.0")
bazel_dep(name = "aspect_rules_js", version = "2.4.0")
bazel_dep(name = "aspect_rules_ts", version = "3.6.3")
bazel_dep(name = "bazel_skylib", version = "1.8.1")
bazel_dep(name = "platforms", version = "1.0.0")

pnpm = use_extension("@aspect_rules_js//npm:extensions.bzl", "pnpm")
pnpm.pnpm(pnpm_version = "9.15.9")
use_repo(pnpm, "pnpm")

npm = use_extension("@aspect_rules_js//npm:extensions.bzl", "npm")
npm.npm_translate_lock(
    name = "npm",
    npmrc = "//:.npmrc",
    pnpm_lock = "//:pnpm-lock.yaml",
)
use_repo(npm, "npm")

Language(s) and/or frameworks involved: typescript, javascript

How to reproduce

Any other information?

No response

[jbedard]

Any idea if this also happens when updating a package?

There are a few spots where packages are referenced by index, so introducing a new package could potentially shift indexes. In theory that should only change some variable names and not change any actions, but I wonder if that could trigger such a thing.

[matthewjh]

pnpm is not particularly stable or consistent in how it serialises lockfile entries, and there are various reported issues such as it flip-flopping between https://example.com:443 and https://example.com, adding tarballUri field versus not, and more recently adding and removing cpu and os fields arbitrarily, so another thing to check here is whether the lockfile is stable before and after install. Needless to say, if the lockfile entries are changed by pnpm, that could cause what you're describing without it being a rules_js issue.