Skip to content

Resolver: Fix browser-spec bare-specifier->relative path redirect for nested/first-party package.jsons#1720

Closed
robhogan wants to merge 1 commit into
mainfrom
export-D105485945
Closed

Resolver: Fix browser-spec bare-specifier->relative path redirect for nested/first-party package.jsons#1720
robhogan wants to merge 1 commit into
mainfrom
export-D105485945

Conversation

@robhogan

@robhogan robhogan commented Jun 2, 2026

Copy link
Copy Markdown
Contributor

Summary:
The browser spec redirect for bare specifiers ("browser": {"foo-pkg": "./shims/foo.js"}) was previously rebased against a path derived by slicing originModulePath after the last node_modules/ segment. That happens to be correct only in the (common) case that the closest package.json is the one at the root of a containing node_modules package. However:

  • It's legal for an NPM package to contain nested package.json files and those may contain redirects - in which case their targets are relative to themselves, not to the package root package.json.

  • For origin modules that aren't located inside a node_modules tree (e.g. project-local source), lastIndexOf('node_modules/') returns -1, producing a malformed root path and either failed resolutions or surprising successes.

This diff replaces that derivation with closestPackageToOrigin.rootPath, which we already look up at the top of resolve. Behaviour is identical in the already-working cases, and corrected otherwise. Matches webpack's AliasFieldPlugin, which rebases against request.descriptionFileRoot.

Changelog:

 - **[Fix]**: Fix browser-spec redirects of bare specifier to relative path, where `package.json` is not directly under `node_modules/<pkg>/`

Reviewed By: huntie

Differential Revision: D105485945

… nested/first-party package.jsons

Summary:
The [browser spec](https://github.com/defunctzombie/package-browser-field-spec) redirect for bare specifiers (`"browser": {"foo-pkg": "./shims/foo.js"}`) was previously rebased against a path derived by slicing `originModulePath` after the last `node_modules/` segment. That happens to be correct only in the (common) case that the closest `package.json` is the one at the root of a containing `node_modules` package. However:

- It's legal for an NPM package to contain nested `package.json` files and those may contain redirects - in which case their targets are relative to themselves, not to the package root `package.json`.

- For origin modules that aren't located inside a `node_modules` tree (e.g. project-local source), `lastIndexOf('node_modules/')` returns `-1`, producing a malformed root path and either failed resolutions or surprising successes.

This diff replaces that derivation with `closestPackageToOrigin.rootPath`, which we already look up at the top of `resolve`. Behaviour is identical in the already-working cases, and corrected otherwise. Matches webpack's `AliasFieldPlugin`, which rebases against `request.descriptionFileRoot`.

Changelog: 
```
 - **[Fix]**: Fix browser-spec redirects of bare specifier to relative path, where `package.json` is not directly under `node_modules/<pkg>/`
````

Reviewed By: huntie

Differential Revision: D105485945
@meta-cla meta-cla Bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Jun 2, 2026
@meta-codesync

meta-codesync Bot commented Jun 2, 2026

Copy link
Copy Markdown
Contributor

@robhogan has exported this pull request. If you are a Meta employee, you can view the originating Diff in D105485945.

@meta-codesync

meta-codesync Bot commented Jun 2, 2026

Copy link
Copy Markdown
Contributor

This pull request has been merged in 385a946.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. fb-exported Merged meta-exported

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant