fix(arborist): don't load store packages' devDependencies as required edges

[manzoorwanijk]

In continuation of our exploration of using install-strategy=linked in the Gutenberg monorepo, which powers the WordPress Block Editor.

Under install-strategy=linked, npm sbom exited non-zero with ESBOMPROBLEMS, reporting the devDependencies of transitive packages (e.g. matcha, tape) as missing: ... required by .... Those dev dependencies are correctly not installed (the same is true under hoisted), yet only the linked strategy treated them as missing-and-required. Hoisted produced a clean SBOM for the same dependency set.

Why

A package in the linked strategy's store lives at node_modules/.store/<key>/node_modules/<pkg>, which makes it a structural tree top (isTop, no parent). Node._loadDeps loads devDependencies for every top node, so each store package — a transitive dependency whose devDependencies are never installed — gained required dev edges. npm sbom reads the filesystem tree via loadActual, queries it, and flags every non-optional missing edge, so those spurious dev edges surfaced as ESBOMPROBLEMS. Standalone npm audit was unaffected because it audits the virtual tree from the lockfile. Hoisted was unaffected because its transitive packages have a real parent, so they are not tops and never load devDependencies.

How

load-actual.js now flags a node as isInStore when its realpath sits inside a node_modules/.store/ directory, matching the flag the isolated reifier already sets on ideal-tree store nodes. Node._loadDeps excludes store nodes from the devDependency load (isTop && !globalTop && path && !this.isInStore), so a store package — a transitive dependency by definition — never gains required dev edges. This makes the linked actual tree's edge semantics match hoisted.

References

Fixes #9610
Part of #9608

[github-actions]

⚠️ Backport to release/v11 failed.

This usually means the cherry-pick had conflicts. Please create a manual backport:

git fetch origin release/v11
git checkout -b backport/v11/9626 origin/release/v11
git cherry-pick -x 851558c02a9c79412aa454113973cab047a47f20
# resolve any conflicts, then:
git push origin backport/v11/9626

Error details

Command failed: git cherry-pick -x 851558c02a9c79412aa454113973cab047a47f20
error: could not apply 851558c02... fix(arborist): don't load store packages' devDependencies as required edges (#9626)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"

[owlstronaut]

@manzoorwanijk would you be able to create the manual backport of this?

[manzoorwanijk]

@manzoorwanijk would you be able to create the manual backport of this?

Sure, I will try.

[manzoorwanijk]

PR for backport to v11: #9633