Dependency pre-bundling cache created with outdated files after branch change

[govizlora]

Describe the bug

After switching to a branch with different dependencies than the current branch, if running vite without running npm install first, the cache will be created with outdated dependency files, with the cache meta's lockfileHash pointing to the latest lockfile.

So, even after running npm install, since the hash of the lockfile doesn't change, subsequent runs of vite will not trigger any re-bundling. This can result in runtime errors that prevent the app from running, requiring a forced re-bundling to fix.

I'm not sure if this bug falls under vite's scope, as the root issue is the mismatch between the lockfile and the dependency files. Running npm install upon checking out branches or before starting the dev server would fix it, but it requires extra configuration efforts.

On vite's side, this could be solved by hashing all the dependency files under node_modules (maybe just the package.json of each dependency), but this might be an overkill.

Maybe we could add some docs under Optimized Dependencies, as this issue can be confusing without understanding what's happening. I'm happy to work on this if an agreement is made.

Reproduction

https://stackblitz.com/~/github.com/govizlora/vite-dep-example

Steps to reproduce

1. Go to https://stackblitz.com/~/github.com/govizlora/vite-dep-example or checkout https://github.com/govizlora/vite-dep-example locally. Make sure you are at the default branch v8.
2. (skip if using stackblitz) Run npm run dev. The app will render a UUID with no issue.
3. Stop the dev server and checkout to branch v3.
4. Run npm run dev (don't run npm install). Notice that the app fails to run, with error like SyntaxError: The requested module 'http://localhost:5173/node_modules/.vite/deps/uuid.js?v=628fb369' doesn't provide an export named: 'default'
5. Even after running npm install, the app still fails with the same error.

System Info

System:
    OS: Linux 5.0 undefined
    CPU: (8) x64 Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
    Memory: 0 Bytes / 0 Bytes
    Shell: 1.0 - /bin/jsh
  Binaries:
    Node: 18.20.3 - /usr/local/bin/node
    Yarn: 1.22.19 - /usr/local/bin/yarn
    npm: 10.2.3 - /usr/local/bin/npm
    pnpm: 8.15.6 - /usr/local/bin/pnpm
  npmPackages:
    vite: ^5.2.0 => 5.2.12

Used Package Manager

npm

Logs

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.

[DreierF]

We also face the problem regularly with pnpm. When the branch is switched vite picks up the changed pnpm-lock.yaml file, while a file watcher is still doing the actual pnpm install based on the new lock file.

For pnpm it looks like the issue could be fixed by looking at node_modules/.pnpm/lock.yaml instead of pnpm-lock.yaml

vite/packages/vite/src/node/optimizer/index.ts

Line 1150 in fe30349

{ name: 'pnpm-lock.yaml', checkPatches: false, manager: 'pnpm' }, // Included in lockfile

This file node_modules/.pnpm/lock.yaml describes the dependencies that are actually installed at the moment vs pnpm-lock.yaml, which describes the packages that should be installed (AFAIU).