fix(npm): only declare the configured package manager as a dependency by jdx · Pull Request #7995 · jdx/mise

jdx · 2026-02-04T10:06:46Z

Summary

Fix npm.rs::get_dependencies() to only return the package manager that's actually configured via npm.package_manager setting
Previously it always returned all package managers (node, npm, bun, pnpm) as dependencies regardless of configuration, creating incorrect dependency edges

This means when npm.package_manager = "bun" and both bun and an npm package are in [tools], running mise install will correctly install bun before the npm package.

Note: mise install <specific-tool> only installs the requested tool — it does not auto-install dependencies from config. Users should run mise install (no args) to install all missing tools in the correct order, or manually install dependencies first.

Closes #7994

Test plan

cargo check passes
Unit tests pass (cargo test backend::npm::tests)
All pre-commit lints pass
CI passes

🤖 Generated with Claude Code

Note

Medium Risk
Changes the dependency graph used to order tool installs, which can affect installation sequencing and potentially reintroduce or avoid circular-dependency edge cases depending on configuration.

Overview
Fixes NPMBackend::get_dependencies() to declare only node, npm (for registry/version queries), and the configured npm.package_manager (bun/pnpm) instead of always depending on all package managers.

Adds explicit circular-dependency handling for npm:npm and for installing the configured package manager itself, and updates unit tests to assert the new default dependency set.

^{Written by Cursor Bugbot for commit 4e078a5. This will update automatically on new commits. Configure here.}

Previously, npm backend's get_dependencies() returned all package managers (node, npm, bun, pnpm) regardless of which one was configured via npm.package_manager. This created incorrect dependency edges and prevented proper installation ordering when using bun or pnpm. Now get_dependencies() checks the npm.package_manager setting and only returns the actually-needed package manager, so the dependency graph correctly orders installations (e.g., bun before npm packages when npm.package_manager=bun). Closes #7994 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

gemini-code-assist · 2026-02-04T10:07:04Z

Summary of Changes

Hello @jdx, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly improves the dependency management for npm-related tools by ensuring that the system only declares the package manager explicitly configured by the user. This targeted approach eliminates erroneous dependency edges, which previously caused issues with tool installation order and overall system reliability, leading to a more accurate and efficient tool provisioning process.

Highlights

Dependency Resolution Logic Refinement: The get_dependencies() function in src/backend/npm.rs has been refactored to dynamically declare package manager dependencies based on the npm.package_manager setting. This ensures that only the explicitly configured package manager (e.g., bun, pnpm, or npm) is listed as a dependency, alongside node.
Corrected Installation Ordering: This change resolves an issue where all potential package managers were always declared as dependencies, leading to incorrect dependency graphs and preventing proper installation sequencing. For example, if bun is configured, it will now be correctly installed before any dependent npm packages.
Enhanced Test Coverage: Unit tests for get_dependencies() have been updated to accurately reflect the new dependency resolution logic. This includes specific assertions for when npm itself is the tool and for other packages under default package manager settings, ensuring the fix behaves as expected.

Changelog

src/backend/npm.rs
- Fixed get_dependencies() to only declare the package manager configured via npm.package_manager as a dependency.
- Resolved incorrect dependency edges and installation ordering issues caused by previously declaring all package managers as dependencies.
- Updated unit tests for get_dependencies() to validate the new dependency resolution logic.

Activity

The author jdx initiated this pull request to address a bug related to incorrect dependency declarations for npm package managers.
The pull request includes a clear summary of the problem and solution, along with a comprehensive test plan.
This change directly addresses and closes issue Bug: mise does not resolve core tool dependencies #7994, which reported the dependency resolution problem.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

Copilot

Pull request overview

This PR fixes a bug in the NPM backend's dependency resolution. Previously, all NPM packages incorrectly declared dependencies on all package managers (node, npm, bun, pnpm) regardless of configuration. Now, get_dependencies() only returns the package manager specified in the npm.package_manager setting, ensuring correct installation ordering when tools are installed via mise install.

Changes:

Modified get_dependencies() to return only the configured package manager as a dependency
Special handling for npm:npm to avoid circular dependencies by only depending on node
Updated tests to verify the new behavior for both npm:npm and other packages

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-04T10:07:20Z

src/backend/npm.rs

+        let mut deps = vec!["node"];
+        match Settings::get().npm.package_manager.as_str() {
+            "bun" => deps.push("bun"),
+            "pnpm" => {


The code adds npm as a dependency when pnpm is configured, but there's no comment explaining why pnpm requires npm as a dependency while bun does not. Consider adding a comment to clarify this design decision.

Suggested change

"pnpm" => {

"pnpm" => {

// When pnpm is selected, we still rely on the npm CLI for certain operations

// (e.g. version/metadata queries), so npm must be installed alongside pnpm.

gemini-code-assist

Code Review

This pull request correctly refactors get_dependencies in the NPM backend to only depend on the configured package manager, which fixes incorrect dependency resolution. The changes are logical and the updated tests are more precise. I have one suggestion to improve the dependency declaration for pnpm to better align with separation of concerns.

gemini-code-assist · 2026-02-04T10:08:06Z

src/backend/npm.rs

+            "pnpm" => {
+                deps.push("npm");
+                deps.push("pnpm");
+            }


While it's true that pnpm can be installed via npm and thus depend on it, this is not always the case. pnpm can also be installed as a standalone binary. To keep concerns separated, this backend should only declare a dependency on pnpm as the configured package manager. The pnpm tool's own backend should be responsible for declaring a dependency on npm if it is required for its installation. This makes the dependency graph more accurate and modular.

"pnpm" => deps.push("pnpm"),

src/backend/npm.rs

github-actions · 2026-02-04T10:25:46Z

Hyperfine Performance

`mise x -- echo`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.2.3 x -- echo`	20.3 ± 0.4	19.7	24.4	1.00
`mise x -- echo`	20.6 ± 0.4	20.0	25.5	1.01 ± 0.03

`mise env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.2.3 env`	19.8 ± 0.6	19.2	25.3	1.00
`mise env`	20.0 ± 0.4	19.3	23.4	1.01 ± 0.04

`mise hook-env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.2.3 hook-env`	20.6 ± 0.3	19.9	21.9	1.00
`mise hook-env`	20.8 ± 0.4	20.0	23.8	1.01 ± 0.02

`mise ls`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.2.3 ls`	18.3 ± 0.3	17.7	20.2	1.00
`mise ls`	18.7 ± 0.3	18.1	20.1	1.02 ± 0.02

`xtasks/test/perf`

Command	mise-2026.2.3	mise	Variance
install (cached)	111ms	112ms	+0%
ls (cached)	69ms	71ms	-2%
bin-paths (cached)	73ms	74ms	-1%
task-ls (cached)	536ms	537ms	+0%

Address review feedback: - Check if tool matches the configured package manager (not just "npm") to avoid circular deps when installing npm:pnpm or npm:bun - Remove npm as a dependency for pnpm - let pnpm's own backend handle its dependencies (separation of concerns) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/backend/npm.rs

Address Cursor Bugbot feedback: npm CLI is always needed for version queries (npm view), even when using bun/pnpm for installation. The previous commit incorrectly removed npm from dependencies when using bun/pnpm, which would cause npm commands to fail. Now: - npm:npm depends on just node (avoid circular dep) - npm:bun/pnpm depends on node + npm (need npm for version queries) - Other packages depend on node + npm + configured package manager Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON, but a Cloud Agent failed to start.}

src/backend/npm.rs

When installing npm:npm with bun or pnpm configured as the package manager, the installation will use that package manager. The dependencies should include it to ensure it's available during installation. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

@corymhall

### 🐛 Bug Fixes - **(env)** resolve sourced env for tool templates by @corymhall in [#7895](#7895) - **(npm)** only declare the configured package manager as a dependency by @jdx in [#7995](#7995) - **(upgrade)** respect use_locked_version when checking tracked configs by @jdx in [#7997](#7997) - ignore MISE_TOOL_VERSION in env var parsing by @jdx in [#8004](#8004) ### New Contributors - @corymhall made their first contribution in [#7895](#7895)

…jdx#7995) ## Summary - Fix `npm.rs::get_dependencies()` to only return the package manager that's actually configured via `npm.package_manager` setting - Previously it always returned all package managers (`node`, `npm`, `bun`, `pnpm`) as dependencies regardless of configuration, creating incorrect dependency edges This means when `npm.package_manager = "bun"` and both `bun` and an npm package are in `[tools]`, running `mise install` will correctly install bun before the npm package. Note: `mise install <specific-tool>` only installs the requested tool — it does not auto-install dependencies from config. Users should run `mise install` (no args) to install all missing tools in the correct order, or manually install dependencies first. Closes jdx#7994 ## Test plan - [x] `cargo check` passes - [x] Unit tests pass (`cargo test backend::npm::tests`) - [x] All pre-commit lints pass - [ ] CI passes 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Medium Risk** > Changes the dependency graph used to order tool installs, which can affect installation sequencing and potentially reintroduce or avoid circular-dependency edge cases depending on configuration. > > **Overview** > Fixes `NPMBackend::get_dependencies()` to declare only `node`, `npm` (for registry/version queries), and the *configured* `npm.package_manager` (`bun`/`pnpm`) instead of always depending on all package managers. > > Adds explicit circular-dependency handling for `npm:npm` and for installing the configured package manager itself, and updates unit tests to assert the new default dependency set. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 4e078a5. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>  --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

@corymhall

### 🐛 Bug Fixes - **(env)** resolve sourced env for tool templates by @corymhall in [jdx#7895](jdx#7895) - **(npm)** only declare the configured package manager as a dependency by @jdx in [jdx#7995](jdx#7995) - **(upgrade)** respect use_locked_version when checking tracked configs by @jdx in [jdx#7997](jdx#7997) - ignore MISE_TOOL_VERSION in env var parsing by @jdx in [jdx#8004](jdx#8004) ### New Contributors - @corymhall made their first contribution in [jdx#7895](jdx#7895)

Copilot AI review requested due to automatic review settings February 4, 2026 10:06

Copilot AI reviewed Feb 4, 2026

View reviewed changes

gemini-code-assist bot reviewed Feb 4, 2026

View reviewed changes

cursor bot reviewed Feb 4, 2026

View reviewed changes

src/backend/npm.rs Outdated Show resolved Hide resolved

cursor bot reviewed Feb 4, 2026

View reviewed changes

src/backend/npm.rs Show resolved Hide resolved

cursor bot reviewed Feb 4, 2026

View reviewed changes

src/backend/npm.rs Show resolved Hide resolved

jdx merged commit d25119a into main Feb 4, 2026
35 checks passed

jdx deleted the fix/npm-deps branch February 4, 2026 23:51

mise-en-dev mentioned this pull request Feb 4, 2026

chore: release 2026.2.4 #7999

Merged

BrewTestBot mentioned this pull request Feb 5, 2026

mise 2026.2.4 Homebrew/homebrew-core#265982

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(npm): only declare the configured package manager as a dependency#7995

fix(npm): only declare the configured package manager as a dependency#7995
jdx merged 4 commits intomainfrom
fix/npm-deps

jdx commented Feb 4, 2026 •

edited by cursor bot

Loading

Uh oh!

gemini-code-assist bot commented Feb 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 4, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Feb 4, 2026

Uh oh!

Uh oh!

github-actions bot commented Feb 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

cursor bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

jdx commented Feb 4, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

gemini-code-assist bot commented Feb 4, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Hyperfine Performance

mise x -- echo

mise env

mise hook-env

mise ls

xtasks/test/perf

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jdx commented Feb 4, 2026 •

edited by cursor bot

Loading

github-actions bot commented Feb 4, 2026 •

edited

Loading

`mise x -- echo`

`mise env`

`mise hook-env`

`mise ls`

`xtasks/test/perf`