fix: only treat whole node_modules path segments as dependencies (fix #17467)

[kakiuwang-ui]

Fixes #17467.

isInNodeModules decides whether a module belongs to the user or to a dependency, and it does that with id.includes('node_modules'). A project whose directory name merely contains that string — node_modules_bug, my_node_modules, a checkout named after this very issue — has every one of its own files classified as a dependency.

The symptom in the original report (a hard Failed to parse source for import analysis on inline <script type="module">) is gone: htmlProxyRE now accepts html-proxy anywhere in the query, so the extra ?v= no longer breaks the match. The cause is still there, and it still misbehaves, just more quietly. Building main and pointing two otherwise identical projects at it:

root                : node_modules_bug
inline-script id    : <root>/index.html?v=40b7386f&html-proxy&index=0.js
/src/main.js id     : <root>/src/main.js?v=40b7386f
sourcemapIgnoreList : true
x_google_ignoreList : [0]

root                : plain_project
inline-script id    : <root>/index.html?html-proxy&index=0.js
/src/main.js id     : <root>/src/main.js
sourcemapIgnoreList : false
x_google_ignoreList : undefined

Two things there. ensureVersionQuery stamps the optimizer's browserHash onto every one of the project's own modules, so they get invalidated whenever deps are re-optimized. And because server.sourcemapIgnoreList defaults to isInNodeModules, Vite emits x_google_ignoreList for the user's own source — DevTools hides your application code from stack traces and won't step into it. Same substring reaches external.ts (a linked workspace package under such a root gets externalized for SSR), optimizer/scan.ts, preAlias.ts and resolve.ts.

The change

node_modules now has to be a whole path segment:

const inNodeModulesRE = /(?:^|[\\/])node_modules(?:[\\/]|$)/

Both separator classes are needed — most call sites hand over a normalized posix id, but packages.ts and tryFsResolve pass native paths, so on Windows they arrive with backslashes. The trailing |$ keeps the old answer for a path that is a node_modules directory with nothing after it; nothing in the tree depends on that today, but making the segment boundary the only difference from main keeps the change to exactly the reported bug.

This is the minimum the reporter asked for, not the "complete fix" also described in the issue. Making isInNodeModules aware of config.root (so a project that genuinely lives inside node_modules is treated as first-party) needs a root threaded through thirteen call sites, several of which run before the config is resolved, and it changes behaviour for the much more common linked-package case. It seems like a separate discussion, and I'd rather not smuggle it in here. Happy to open a follow-up if you want it.

Prior attempts

#21549 (closed by its author) and #21638 (auto-closed as bot-likely) both went at the leading separator only. Neither got review comments, so I don't think there is a rejected design here, but flagging them so this isn't reviewed as a duplicate.

Test

Unit tests on isInNodeModules itself. The negative cases are the point — they're what tells a correct fix from a half one. I checked that by breaking it three ways and re-running:

• back to includes('node_modules') → fails on /project/node_modules_bug/src/main.js
• leading separator only, /(?:^|[\\/])node_modules/ → fails on the same case
• trailing separator only, /node_modules(?:[\\/]|$)/ → fails on /project/my_node_modules/src/main.js

No playground test: reproducing this needs a project directory named node_modules_bug, and adding one to playground/ would collide with the repo's own **/node_modules/** ignores in the watcher, the workspace globs and the test runner. If you'd rather see it covered end-to-end I can add a fixture that builds the path at runtime instead.

Ran pnpm test-unit, pnpm test-serve, pnpm test-build and pnpm test-serve-bundled — all green.

[kakiuwang-ui]

The windows-latest job is red on Test serve (bundled dev), but it reports 69 passed | 18 skipped, 640 passed | 237 skipped and zero assertion failures — the only error is [vitest-pool]: Worker exited unexpectedly after the suite finished.

Same signature shows up on main: e.g. run 33731302439 (91 passed | 17 skipped, 1131 passed, one Worker exited unexpectedly). Across the last 20 main runs of this workflow, that job failed 3 times, always this way.

I ran test-unit, test-serve, test-build and test-serve-bundled locally on this branch and all four are green, so I do not think this is caused by the change. Happy to be told otherwise if you have seen it correlate with something.

[kakiuwang-ui]

One more data point on that Windows failure, since the counts give it away.

Test Files  69 passed | 18 skipped (88)

69 + 18 = 87, but the total is 88. One test file never reported at all — that is the fork that died, and its result went with it rather than being recorded as a failure. Running the same command locally accounts for everything: 69 passed | 18 skipped (87).

The main run I linked earlier has the identical arithmetic: 91 passed | 17 skipped (109), i.e. 108 of 109.

So the failure is not on any assertion that actually executed — it is a worker process dying in the test-serve-bundled step, where setup alone takes 46.85s on the Windows runner. Not something this diff can reach.

[btea]

LGTM

[bluwy]

This PR breaks our AI policy, but since the fix here seems good and covers edge cases well unlike other PRs, I'll give it a pass.

[bluwy]

/ecosystem-ci run

[pkg-pr-new]

Open in StackBlitz

@vitejs/plugin-legacy

pnpm add https://pkg.pr.new/@vitejs/plugin-legacy@23437 -D

npm i https://pkg.pr.new/@vitejs/plugin-legacy@23437 -D

yarn add https://pkg.pr.new/@vitejs/plugin-legacy@23437.tgz -D

vite

pnpm add https://pkg.pr.new/vite@23437 -D

npm i https://pkg.pr.new/vite@23437 -D

yarn add https://pkg.pr.new/vite@23437.tgz -D

commit: d5690c0

[vite-ecosystem-ci]

📝 Ran ecosystem CI on b79f185: Open

suite	result	latest scheduled
nitro	❌ failure	✅ success
netlify-vite-plugin	❌ failure	❌ failure
react-router	❌ failure	❌ failure
storybook	❌ failure	❌ failure
vite-plugin-rsc	❌ failure	❌ failure
qwik	❌ failure	❌ failure
tanstack-start	✅ success	⏹️ cancelled
vitest	❌ failure	❌ failure

✅ analogjs, astro, module-federation, marko, laravel, sveltekit, vinext, vike, quasar, vite-plugin-svelte, vite-plugin-cloudflare, unocss, vitepress, nuxt, vite-environment-examples, vuepress, vite-plugin-pwa, vite-plugin-vue, vite-plugin-react, vite-setup-catalogue, waku