Skip to content

[BUG] install-strategy=linked: an applied override is reported invalid by npm ls (exit 1) #9619

Description

@manzoorwanijk

Part of #9608.

Is there an existing issue for this?

  • I have searched the existing issues

This issue exists in the latest npm version

  • I am using the latest npm

This is not just a request to bump a dependency for a CVE

  • This is not solely a request to bump a dependency for a CVE

Current Behavior

When an override forces a transitive dependency to a version outside the dependent's declared range, the override is applied (the store contains the overridden version), but under install-strategy=linked npm ls --all reports the edge as invalid: "<range>" and exits 1 (ELSPROBLEMS). The hoisted strategy reports the same edge as overridden and exits 0.

Expected Behavior

An applied override should be reported as overridden (not invalid) under the linked strategy, and npm ls should exit 0, matching the hoisted strategy.

Steps To Reproduce

cd "$(mktemp -d)"
echo 'install-strategy=linked' > .npmrc
cat > package.json <<'EOF'
{ "name": "ov", "version": "1.0.0",
  "dependencies": { "minimatch": "3.0.4" },
  "overrides": { "brace-expansion": "2.0.1" } }
EOF
# 2.0.1 is outside minimatch@3.0.4's declared range (brace-expansion ^1.1.7)
npm install >/dev/null
npm ls --all
#   linked:  brace-expansion@2.0.1 invalid: "^1.1.7" from .../minimatch   -> ELSPROBLEMS, exit 1
#   hoisted: brace-expansion@2.0.1 overridden                            -> exit 0

Environment

  • npm: 12.0.0-pre.1 (latest)
  • Node.js: v24.17.0
  • OS Name: macOS (Darwin 25.5.0)
  • System Model Name: MacBook (arm64)
  • npm config:
install-strategy=linked

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions