Skip to content

fix(arborist): avoid repeated peer placement checks - #9938

Open
drewmt wants to merge 1 commit into
npm:latestfrom
drewmt:fix/peer-cycle-livelock
Open

fix(arborist): avoid repeated peer placement checks#9938
drewmt wants to merge 1 commit into
npm:latestfrom
drewmt:fix/peer-cycle-livelock

Conversation

@drewmt

@drewmt drewmt commented Sep 1, 2026

Copy link
Copy Markdown

Summary

Dense cyclic peer graphs can reach the same placement state through many different paths. The existing peerPath guard prevents direct recursion, but still repeats equivalent checks and can leave npm install CPU-bound indefinitely.

This keeps a traversal-scoped record of peer checks keyed by the peer edge, placement target, and deepest target. Distinct placement contexts are still evaluated, while duplicate paths are skipped.

The reported install now completes successfully with 454 packages instead of remaining CPU-bound.

Fixes #9934

Testing

  • Full @npmcli/arborist test suite
  • npm run eslint -w @npmcli/arborist
  • npm install @deepseek-ai/dsh@0.1.1-rc.2 --package-lock-only --ignore-scripts on Node 24.15.0 and npm 12.0.2

@drewmt
drewmt requested review from a team as code owners September 1, 2026 06:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] npm install livelocks (100% CPU, infinite CanPlaceDep/canPlacePeers cycle) on dependency graph with cyclic peerDependencies

1 participant