Skip to content

fix: validate package version when traversing directories in search of a matching node module#9424

Merged
mmaietta merged 16 commits into
masterfrom
fix/node-collector3
Dec 7, 2025
Merged

fix: validate package version when traversing directories in search of a matching node module#9424
mmaietta merged 16 commits into
masterfrom
fix/node-collector3

Conversation

@mmaietta
Copy link
Copy Markdown
Collaborator

@mmaietta mmaietta commented Dec 6, 2025

  • When locating a package, semver validation has been added to make sure the correct module path is selected. This is particularly relevant when there are two versions (one hoisted and the other not) and only one of them is a prod dep => fixes builds broken since v26.3.0 #9394
  • Supports both upward and downward (BFS) searches for when searching for a matching hoisted (or not) node module.
  • Performance improvement in migrating more fs operations to be memoized in the cache
  • Refactors the cache to leverage typescript Proxy for dot-notation access into each of the subcaches within the class.
  • Also clean up the code a little in general

Additional note:
Test snapshots were reverted back to 26.2.0 and then the fixed node module collector logic here was run against those pre-corepack snapshots. This was done to start from a "clean" slate

Should also fix #9423

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Dec 6, 2025

🦋 Changeset detected

Latest commit: 91e8363

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 8 packages
Name Type
app-builder-lib Patch
dmg-builder Patch
electron-builder-squirrel-windows Patch
electron-builder Patch
electron-forge-maker-appimage Patch
electron-forge-maker-nsis-web Patch
electron-forge-maker-nsis Patch
electron-forge-maker-snap Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@socket-security
Copy link
Copy Markdown

socket-security Bot commented Dec 6, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedtiny-typed-emitter@​2.1.01001009280100
Addedtiny-async-pool@​1.3.01001009280100

View full report

@mmaietta mmaietta merged commit e3f3592 into master Dec 7, 2025
33 checks passed
@mmaietta mmaietta deleted the fix/node-collector3 branch December 7, 2025 21:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

No node modules found in collection builds broken since v26.3.0

1 participant