SIGN IN SIGN UP

fix(arborist): apply overrides across a file:/workspace link boundary (#9671)

A root `overrides` entry targeting a transitive dependency was silently
dropped when the path to that dependency crossed a `file:`/workspace
link, so the dependency resolved to its un-overridden version and the
lockfile pinned the wrong version. It reproduced under both the
`hoisted` and `linked` install strategies, while the same override
applied correctly when the dependency was reached without crossing a
link.

Override rules propagate through dependency edges, but a Link and its
target are not edge-connected, so they are bridged by forwarding the
Link's `OverrideSet` to its target. That forwarding ran while the
target's subtree was still unbuilt, so its guard found no matching rule
and never forwarded, leaving the target and its descendant edges without
the rule.

`buildIdealTree` now forwards a link's overrides to its target before
the target's subtree is resolved, so descendant edges inherit the rule
as they are added, matching how a registry node always inherits its
ancestor's `OverrideSet`. `loadActual` now repropagates overrides
through links once all edges are resolved, so a transitive override
reached through a `file:` link is reported as `overridden` rather than
`invalid` by `npm ls`.

## References

Fixes #9659
M
Manzoor Wani committed
968e42fbd62eb3a6f446466359c9431f41d76b2b
Parent: ae6dbeb
Committed by GitHub <noreply@github.com> on 6/26/2026, 1:30:42 PM