Supporting artifact for investigation thread thr_sq66xycivu. Referenced from the bug report Evidence section; not part of the GitHub issue body.
This is an exhaustive audit of the 65 direct runtime dependencies declared by the npm 11.16.0 manifest bundled in the active BB 0.43.0 Linux AppImage.
The audit compared every key in:
.../resources/app.asar.unpacked/node_modules/npm/package.json → dependencies
against both locations that Node's CommonJS resolver can use for the embedded npm:
.../node_modules/npm/node_modules/<package>/package.json
.../node_modules/<package>/package.json
npm/node_modules/ does not exist in this bundle. The list below is therefore exhaustive for npm's first-order declared runtime dependencies. It does not attempt to enumerate transitive dependencies of the absent packages, because their package manifests are not present in the bundle to inspect.
- npm version: 11.16.0
- Declared direct runtime dependencies: 65
- Physically absent: 60
- Physically present only as unrelated hoisted siblings: 5
- Present and satisfying npm's declared range: 2
- Present but version-incompatible: 3
This is enough to prevent the embedded npm CLI from starting: its first required missing dependency is proc-log.
| Package | Declared range |
|---|---|
@isaacs/string-locale-compare |
^1.1.0 |
@npmcli/arborist |
^9.7.0 |
@npmcli/config |
^10.10.0 |
@npmcli/fs |
^5.0.0 |
@npmcli/map-workspaces |
^5.0.3 |
@npmcli/metavuln-calculator |
^9.0.3 |
@npmcli/package-json |
^7.0.5 |
@npmcli/promise-spawn |
^9.0.1 |
@npmcli/redact |
^4.0.0 |
@npmcli/run-script |
^10.0.4 |
@sigstore/tuf |
^4.0.2 |
abbrev |
^4.0.0 |
archy |
~1.0.0 |
cacache |
^20.0.4 |
chalk |
^5.6.2 |
ci-info |
^4.4.0 |
fastest-levenshtein |
^1.0.16 |
fs-minipass |
^3.0.3 |
glob |
^13.0.6 |
hosted-git-info |
^9.0.3 |
init-package-json |
^8.2.5 |
is-cidr |
^6.0.4 |
json-parse-even-better-errors |
^5.0.0 |
libnpmaccess |
^10.0.3 |
libnpmdiff |
^8.1.9 |
libnpmexec |
^10.2.9 |
libnpmfund |
^7.0.23 |
libnpmorg |
^8.0.1 |
libnpmpack |
^9.1.9 |
libnpmpublish |
^11.2.0 |
libnpmsearch |
^9.0.1 |
libnpmteam |
^8.0.2 |
libnpmversion |
^8.0.4 |
make-fetch-happen |
^15.0.6 |
minimatch |
^10.2.5 |
minipass |
^7.1.3 |
minipass-pipeline |
^1.2.4 |
node-gyp |
^12.3.0 |
nopt |
^9.0.0 |
npm-audit-report |
^7.0.0 |
npm-install-checks |
^8.0.0 |
npm-package-arg |
^13.0.2 |
npm-pick-manifest |
^11.0.3 |
npm-profile |
^12.0.1 |
npm-registry-fetch |
^19.1.1 |
npm-user-validate |
^4.0.0 |
p-map |
^7.0.4 |
pacote |
^21.5.0 |
parse-conflict-json |
^5.0.1 |
proc-log |
^6.1.0 |
qrcode-terminal |
^0.12.0 |
read |
^5.0.1 |
spdx-expression-parse |
^4.0.0 |
ssri |
^13.0.1 |
supports-color |
^10.2.2 |
tar |
^7.5.15 |
text-table |
~0.2.0 |
tiny-relative-date |
^2.0.2 |
treeverse |
^3.0.0 |
validate-npm-package-name |
^7.0.2 |
These packages were found in the parent node_modules directory rather than in npm's own node_modules. Only graceful-fs and ms satisfy the ranges declared by npm 11.16.0.
| Package | Declared range | Found version | Satisfies range |
|---|---|---|---|
graceful-fs |
^4.2.11 |
4.2.11 |
Yes |
ini |
^6.0.0 |
1.3.8 |
No |
ms |
^2.1.2 |
2.1.3 |
Yes |
semver |
^7.8.1 |
7.7.4 |
No |
which |
^6.0.1 |
2.0.2 |
No |
The first line of the bundled npm exit handler is:
const { log, output, META } = require('proc-log')Because proc-log is one of the 60 absent direct dependencies, invoking the bundled npm fails before it can process an install request. The plugin installer therefore fails independently of the selected community plugin or its repository.