Is there an existing issue for this?
This issue exists in the latest npm version
This is not just a request to bump a dependency for a CVE
Current Behavior
When an ERESOLVE conflict involves a package with a dense workspace dependents graph, npm prints only A complete log of this run can be found in and exits 1. Building the full eresolve-report.txt throws RangeError: Invalid string length, and that error is never printed or written to the debug log. Below the crash threshold the report still grows exponentially (400 MB at 28 workspaces).
Expected Behavior
The normal ERESOLVE message is printed, and the full report stays a reasonable size.
Steps To Reproduce
mkdir x && cd x
echo '{"name":"root","workspaces":["w/*"],"dependencies":{"react":"17.0.2"}}' > package.json
# w0 -> react; wN -> w(N-1), w(N-2)
for i in $(seq 0 29); do
d='"react":"17.0.2"'; [ $i -gt 0 ] && d="\"w$((i-1))\":\"1.0.0\""; [ $i -gt 1 ] && d="$d,\"w$((i-2))\":\"1.0.0\""
mkdir -p w/w$i && echo "{\"name\":\"w$i\",\"version\":\"1.0.0\",\"dependencies\":{$d}}" > w/w$i/package.json
done
npm i --package-lock-only
npm i react-dom@18.3.1 --package-lock-only; echo "exit=$?"
# expected: "npm error code ERESOLVE ..." then exit=1
# actual: only "npm error A complete log of this run can be found in: ..." then exit=1
Environment
- npm: 12.0.2 and
latest (c9876d7)
- Node.js: v24.18.0
- OS Name: macOS (Darwin 25.6.0)
- npm config: defaults (
install-strategy=linked fails the same way)
Is there an existing issue for this?
This issue exists in the latest npm version
This is not just a request to bump a dependency for a CVE
Current Behavior
When an ERESOLVE conflict involves a package with a dense workspace dependents graph, npm prints only
A complete log of this run can be found inand exits 1. Building the fulleresolve-report.txtthrowsRangeError: Invalid string length, and that error is never printed or written to the debug log. Below the crash threshold the report still grows exponentially (400 MB at 28 workspaces).Expected Behavior
The normal ERESOLVE message is printed, and the full report stays a reasonable size.
Steps To Reproduce
Environment
latest(c9876d7)install-strategy=linkedfails the same way)