fix(pack): bundle dependencies declared in bundleDependencies by zkochan · Pull Request #11524 · pnpm/pnpm

zkochan · 2026-05-07T15:18:04Z

Summary

Fixes #11519: pnpm pack in pnpm 11 silently dropped every package listed in bundleDependencies / bundledDependencies, producing tarballs that no longer contained the bundled node_modules/<dep> files that v10 produced.
Root cause: the npm-packlist v10 upgrade (#10658) changed its API to require the caller to pre-populate the dependency tree's edgesOut Map. The wrapper in fs/packlist passed an empty Map, so npm-packlist's gatherBundles() looked up each declared name, found nothing, and skipped them all.
Fix: fs/packlist now reads each bundled dep's package.json (walking up parent node_modules to support hoisted layouts), recursively populates edgesOut for transitive deps of bundled packages, and normalizes bundleDependencies: true to an explicit array (npm-packlist iterates the field directly).

Test plan

New pack: bundles dependencies listed in bundleDependencies test in releasing/commands/test/publish/pack.ts — verifies a declared dep is included and an undeclared dep is excluded.
New pack: bundles transitive dependencies of bundled dependencies (hoisted) test — verifies transitive bundling under a hoisted layout.
All 33 existing tests in releasing/commands/test/publish/pack.ts continue to pass.
Manual e2e check with the bundled pnpm/dist/pnpm.mjs: a fixture matching the issue's reproduction now ships node_modules/foo/foo.js and node_modules/foo/package.json in the tarball, matching v10 behavior.

Written by an agent (Claude Code, claude-opus-4-7).

Summary by CodeRabbit

Bug Fixes
- "pnpm pack" now correctly includes dependencies declared in bundleDependencies/bundledDependencies (including when set to true), so bundled packages are properly present in generated tarballs.
Tests
- Added integration tests that assert packed tarballs include or exclude bundled dependencies as configured, covering single-list, "bundle all", and transitive bundling scenarios.

The npm-packlist v10 upgrade in pnpm 11 changed its API to require the caller to pre-populate the dependency tree's edgesOut Map. Our wrapper passed an empty Map, causing gatherBundles() to silently skip every bundled dep. Populate edgesOut from bundleDependencies / bundledDependencies (plus transitive deps for nested bundled packages, walking up parent node_modules to find hoisted deps), and normalize bundleDependencies: true to an explicit array since npm-packlist iterates it directly.

coderabbitai · 2026-05-07T15:18:29Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 173fb10a-e0e1-47f9-8963-4bd0b0182aac

📥 Commits

Reviewing files that changed from the base of the PR and between dbb51c1 and 2176b79.

📒 Files selected for processing (1)

fs/packlist/src/index.ts

🚧 Files skipped from review as they are similar to previous changes (1)

fs/packlist/src/index.ts

📜 Recent review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

GitHub Check: Compile & Lint

📝 Walkthrough

Walkthrough

This PR fixes pnpm pack failing to include dependencies declared in bundleDependencies or bundledDependencies. The packlist module now builds a dependency tree from node_modules and normalizes the manifest's bundle fields before passing it to npm-packlist, alongside new tests validating the bundle inclusion behavior.

Changes

Bundle Dependencies Fix

Layer / File(s)	Summary
Type Definitions `fs/packlist/src/index.ts`	Internal `Edge` and `TreeNode` types define dependency tree structure with metadata and linkage.
Dependency Selection & Resolution `fs/packlist/src/index.ts`	Helpers compute root/nested bundled deps and `resolveDependency()` walks `node_modules` upward to locate dependency `package.json`.
Tree Construction `fs/packlist/src/index.ts`	`buildRootTree()` and `buildBundledTree()` assemble `TreeNode` objects, deduplicate via `seen`, and populate edges for bundled dependencies.
Packlist Integration `fs/packlist/src/index.ts`	`packlist()` loads/accepts manifest, builds the dependency tree, passes it to `npm-packlist`, and strips leading `./` from returned paths.
Package JSON Reader `fs/packlist/src/index.ts`	`readPackageJson()` switched to sync `readFileSync` while preserving ENOENT→`{}` and rethrowing other errors.
Tests `releasing/commands/test/publish/pack.ts`	Three tests added: named `bundleDependencies`, `bundleDependencies: true` (bundle all), and `bundledDependencies` including transitive dependency; each asserts expected files in extracted `package/` tar contents.
Release Documentation `.changeset/pack-bundle-dependencies.md`	Patch changeset for `@pnpm/fs.packlist` and `pnpm` documenting the fix for the npm-packlist API change that dropped `bundleDependencies`.

Possibly related issues

pnpm 11 stopped bundling dependencies from bundleDependencies array #11519 — This PR directly fixes the reported bug where pnpm pack omitted dependencies listed in bundleDependencies/bundledDependencies due to the npm-packlist integration change.

Possibly related PRs

pnpm/pnpm#11478 — Related bundling changes that normalize bundle fields and affect bundled dependency discovery/packing.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Poem

🐰 I hopped through node_modules, one by one,
Found bundles hiding where the light was none.
I stitched the tree and called pack's name,
Now every dep arrives within the same 🎁
Hooray — no package left behind, hop!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and accurately describes the main fix: bundle dependencies declared in bundleDependencies, which is the core issue addressed by this pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/11519

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull request overview

Fixes a pnpm 11 regression where pnpm pack stopped including dependencies declared via bundleDependencies/bundledDependencies by rebuilding the dependency tree data (edgesOut) required by npm-packlist v10.

Changes:

Build a dependency-tree structure in @pnpm/fs.packlist that pre-populates edgesOut for bundled deps (including transitives) and normalizes bundleDependencies to an iterable value.
Add pack tests covering bundling of direct and transitive bundled dependencies under a hoisted layout.
Add a changeset to release the fix as a patch for @pnpm/fs.packlist and pnpm.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
`fs/packlist/src/index.ts`	Builds/populates the `npm-packlist` tree so bundled deps are discoverable and included in pack output.
`releasing/commands/test/publish/pack.ts`	Adds regression tests ensuring bundled deps (and transitives) are included in produced tarballs.
`.changeset/pack-bundle-dependencies.md`	Declares patch releases for the fix.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Address Copilot review comment on #11524: add a test that verifies a package with bundleDependencies: true bundles its declared dependencies and excludes other entries in node_modules.

Replace the isProjectRoot boolean parameter with two dedicated entry points: buildRootTree applies the project-root specifics (read bundleDependencies/bundledDependencies, normalize the manifest field that npm-packlist iterates), and buildBundledTree handles nested bundled deps (their own dependencies + optionalDependencies). Edge population is shared via populateEdges, node creation via makeNode, and the dep-name selection split into getRootBundledDeps / getNestedBundledDeps.

The tree-building loop is sequential by design (the shared `seen` map deduplication relies on it), so async fs adds Promise overhead and no-await-in-loop lint suppressions for no benefit. Switch the internal helpers to fs.readFileSync / fs.statSync; only the public packlist() remains async because npm-packlist itself is async.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

- Fixes [#11519](#11519): `pnpm pack` in pnpm 11 silently dropped every package listed in `bundleDependencies` / `bundledDependencies`, producing tarballs that no longer contained the bundled `node_modules/<dep>` files that v10 produced. - Root cause: the npm-packlist v10 upgrade ([#10658](#10658)) changed its API to require the caller to pre-populate the dependency tree's `edgesOut` Map. The wrapper in `fs/packlist` passed an empty Map, so npm-packlist's `gatherBundles()` looked up each declared name, found nothing, and skipped them all. - Fix: `fs/packlist` now reads each bundled dep's `package.json` (walking up parent `node_modules` to support hoisted layouts), recursively populates `edgesOut` for transitive deps of bundled packages, and normalizes `bundleDependencies: true` to an explicit array (npm-packlist iterates the field directly).

Copilot AI review requested due to automatic review settings May 7, 2026 15:18

Copilot started reviewing on behalf of zkochan May 7, 2026 15:18 View session

Copilot AI reviewed May 7, 2026

View reviewed changes

Comment thread fs/packlist/src/index.ts Outdated

zkochan added 2 commits May 7, 2026 17:48

test(pack): cover bundleDependencies: true normalization path

dbb51c1

Address Copilot review comment on #11524: add a test that verifies a package with bundleDependencies: true bundles its declared dependencies and excludes other entries in node_modules.

Copilot AI review requested due to automatic review settings May 8, 2026 19:50

Copilot started reviewing on behalf of zkochan May 8, 2026 19:51 View session

Copilot AI reviewed May 8, 2026

View reviewed changes

coderabbitai Bot approved these changes May 8, 2026

View reviewed changes

zkochan merged commit 219854f into main May 8, 2026
11 of 13 checks passed

zkochan deleted the fix/11519 branch May 8, 2026 20:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(pack): bundle dependencies declared in bundleDependencies#11524

fix(pack): bundle dependencies declared in bundleDependencies#11524
zkochan merged 4 commits into
mainfrom
fix/11519

zkochan commented May 7, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented May 7, 2026 •

edited

Loading

Walkthrough

Changes

Possibly related issues

Possibly related PRs

Estimated code review effort

Poem

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

zkochan commented May 7, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Possibly related issues

Possibly related PRs

Estimated code review effort

Poem

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

zkochan commented May 7, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 7, 2026 •

edited

Loading