SIGN IN SIGN UP

fix(arborist): forward transitive overrides through linked store links (#9658)

In continuation of our exploration of using `install-strategy=linked` in
the [Gutenberg
monorepo](https://github.com/WordPress/gutenberg/pull/75814), which
powers the WordPress Block Editor.

Under `install-strategy=linked`, an override that forces a
**transitive** dependency to a version outside its dependent's declared
range was applied on disk but reported as `invalid` by `npm ls --all`,
which then exited 1 (`ELSPROBLEMS`). The hoisted strategy reports the
same edge as `overridden` and exits 0. The bug only surfaced when the
overridden package's dependent was itself a transitive (store) package —
a direct dependency of the root was handled correctly.

`npm ls` rebuilds the actual tree from the `.store` layout, and an
OverrideSet propagates down the tree through
`Link.recalculateOutEdgesOverrides`, which forwards the set from a store
symlink to its target node. A prior fix (npm/cli#9357) gated that
forwarding on a rule naming a **direct** dependency of the target, to
avoid flipping an unrelated target to "has overrides" and making `npm
ci` re-resolve lockfile-pinned edges. That gate was too narrow: a store
link whose own direct deps do not name the overridden package never
forwarded the set, so the chain to the deeper `dependent → overridden`
edge never received the rule and was reported `invalid`.

The fix walks the target's subtree (following resolved edges,
dereferencing links) and forwards the set when an override rule actually
applies to any reachable edge, matched via `getEdgeRule` on name and
spec so a non-applicable version-qualified rule still does not flip an
intermediate node. Because override propagation is event-driven during
load, a store link can run its check before its subtree is resolved;
`loadActual` therefore re-forwards through links once the tree is
complete, so the filesystem-scan path resolves transitive overrides as
`overridden` rather than `invalid`.

## References

Fixes #9619
M
Manzoor Wani committed
541c2865bf2a961554c889f5764bf182cc7f60e2
Parent: f9e3a80
Committed by GitHub <noreply@github.com> on 6/25/2026, 6:10:32 PM