You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is not just a request to bump a dependency for a CVE
This is not solely a request to bump a dependency for a CVE
Current Behavior
Under install-strategy=linked, a direct registry dependency is reported by npm query with its node_modules/.store/<key>/node_modules/<pkg> backing path as its location, instead of the logical node_modules/<pkg> edge location. The hoisted strategy reports the logical location. This breaks tooling that consumes npm query locations.
Expected Behavior
npm query should report the logical dependency location (node_modules/<pkg>) for direct dependencies under the linked strategy, matching the hoisted strategy.
Activity
fix(query): report logical dep location under linked strategy (#9656)