Skip to content

fix(arborist): preserve unowned global bin links - #10223

Open
harshitdeora wants to merge 1 commit into
npm:latestfrom
harshitdeora:fix/preserve-unowned-global-bin-links
Open

harshitdeora wants to merge 1 commit into
npm:latestfrom
harshitdeora:fix/preserve-unowned-global-bin-links

Conversation

@harshitdeora

Copy link
Copy Markdown

Fixes #10219.

On POSIX, global uninstall retires paths listed by the package manifest. If a global bin has been redirected to a different package, the uninstall also removes the other package's working command.

Before retiring a POSIX global package, check which listed symlinks point inside its package directory. This preserves links into other packages and regular files. Owned links to missing targets are still retired, and a missing bin path is harmless.

Validation on Linux (WSL2) with Node 24.15.0:

  • An offline npm CLI run with two locally packed packages reproduced the lost command on base. With this change, uninstall removes the package and its owned command while the other package's command still executes.
  • The same Arborist regression fails on base when reading the deleted link and passes all eight assertions with this change. It covers relative and absolute links, similarly named packages, dangling links, missing links, and regular files.
  • The existing Arborist global install and removal test group, ESLint on the changed files, and git diff --check passed.

Local validation covered the affected POSIX path. The full npm test matrix was not run.

@harshitdeora
harshitdeora requested a review from a team as a code owner November 4, 2026 15:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] npm uninstall -g deletes a bin link pointing into another installed package

1 participant