Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Package map entry whose url resolves to a directory-form URL never matches its files

Geschlossen
  • Stimmt etwas nicht?
#66,043 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Anfängerfreundlichkeit
78/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
javascript
Bereich
backend

Rechercherichtung

Lies lib/internal/modules/package_map.js, insbesondere #parse und #getKeyForPath, und untersuche anschließend die Fixtures unter test/fixtures/package-map/. Füge einen Regressionstest hinzu, der eine URL in Verzeichnisform wie ".." verwendet, und überprüfe, dass das Anfordern der Abhängigkeit erfolgreich aufgelöst wird, statt ERR_PACKAGE_MAP_EXTERNAL_FILE auszulösen.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Version

v26.8.1

Platform

Windows 11 x64 (the mechanism is platform independent; see analysis)

Subsystem

module, package maps

What steps will reproduce the bug?

A package entry whose url resolves to a directory-form URL (one ending in /) never matches any file inside it. The natural relative spellings for "the directory above the map file" — "..", "../", ".", "./" — all produce such a URL.

project/
  package.json          {"private":true}
  index.cjs             console.log(require("dep"));
  node_modules/
    .package-map.json
    dep/package.json    {"name":"dep","main":"index.cjs"}
    dep/index.cjs       module.exports="ok";

node_modules/.package-map.json:

{
  "packages": {
    "root": { "url": "..", "dependencies": { "dep": "dep" } },
    "dep": { "url": "./dep", "dependencies": {} }
  }
}

$ node --experimental-package-map=node_modules/.package-map.json index.cjs
How often does it reproduce? Is there a required condition?

Always. The condition is that the entry's url resolves to a URL ending in /.

Results for the same map with only the root url changed:

root url result
".." ERR_PACKAGE_MAP_EXTERNAL_FILE
"../" ERR_PACKAGE_MAP_EXTERNAL_FILE
"." ERR_PACKAGE_MAP_EXTERNAL_FILE
"./" ERR_PACKAGE_MAP_EXTERNAL_FILE
absolute file: URL without a trailing slash ok
What is the expected behavior? Why is that the expected behavior?

require("dep") from index.cjs should print ok. The documentation says url is "An absolute or relative URL ... parsed using the WHATWG URL API, using the configuration file URL as base", and puts no restriction on directory-form URLs. "." and ".." are ordinary relative URLs that denote directories, which is what a package entry points at.

What do you see instead?
Error [ERR_PACKAGE_MAP_EXTERNAL_FILE]: Cannot resolve "dep" from ".../nodemap/index.cjs": file is not within any package defined in .../nodemap/node_modules/.package-map.json
    at PackageMap.resolve (node:internal/modules/package_map:179:13)
    at packageMapResolve (node:internal/modules/package_map:305:14)
    at tryPackageMapResolveCJS (node:internal/modules/cjs/loader:697:18)
  code: 'ERR_PACKAGE_MAP_EXTERNAL_FILE'
Additional information

Cause, in lib/internal/modules/package_map.js (v26.8.1):

  • #parse stores the package path unnormalized: absolutePath = fileURLToPath(packageURL) followed by this.#pathToKey.set(absolutePath, key). For a directory-form URL this keeps the trailing separator, for example /home/u/proj/.
  • #getKeyForPath does filePath = pathResolve(filePath) and then walks up with dirname, comparing by exact string. pathResolve and dirname never yield a trailing separator except at a filesystem root, so the stored key is unreachable and resolve() throws ERR_PACKAGE_MAP_EXTERNAL_FILE.

The same reasoning applies on POSIX: fileURLToPath keeps the trailing /, and path.posix.dirname("/home/u/proj/index.cjs") is /home/u/proj.

Suggested fix: normalize when storing, that is absolutePath = pathResolve(fileURLToPath(packageURL)) in #parse, so stored paths, duplicate detection and lookup all use the same spelling. Normalizing only in #getKeyForPath would leave the stored identity inconsistent.

Test coverage: the fixtures in test/fixtures/package-map/ use only "./name" style URLs, so no test exercises a directory-form URL. A regression test could add an entry with url: ".." and require a dependency from a file in that directory.

This is not the same as #65501 / #65502, which concern subpaths escaping the target package directory.

Found via pnpm, which writes "url": ".." for the workspace root importer in node_modules/.package-map.json, so no file at a project root can resolve a bare specifier.

Vorherrschende Sprache
JavaScript
Sterne
122k
Forks
37.4k
Ø Merge
4 T. 17 Std.
Gemergte PRs (30 T.)
300

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus nodejs/node

Alle Issues in nodejs/node

Ähnliche Issues

Weitere Issues zu JavaScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.