When running with the latest Node v25.6.1 and npm v11, npm's arborist dedupe algorithm fails when parsing dependency trees without explicit versions, throwing a TypeError: Invalid Version: error. By injecting the specs into the package.json, npm resolves the ideal-tree cleanly without raising the Invalid Version exception. I've tested this patch locally and it completely resolves the crash loop.

TL;DR

Update the package.json generation to include dependencies from params.missingSpecs to prevent npm's arborist dedupe algorithm from failing.

Guidance

• Verify that the params.missingSpecs array contains the expected dependency specifications before populating the dependencies field in the generated package.json.
• Test the updated code with different dependency versions to ensure the fix works across various scenarios.
• Consider adding error handling for cases where params.missingSpecs is empty or malformed.
• Review the npm documentation for any changes to the arborist algorithm or dependency parsing in version 11.

Example

The provided code snippet demonstrates how to populate the dependencies field in the generated package.json:

const __deps = {};
for (const __s of params.missingSpecs) {
  const __i = __s.startsWith("@") ? __s.lastIndexOf("@") : __s.indexOf("@");
  if (__i > 0) __deps[__s.slice(0, __i)] = __s.slice(__i+1);
}

Notes

This fix assumes that params.missingSpecs contains the necessary dependency specifications. If this is not the case, additional changes may be required to populate the dependencies field correctly.

Recommendation

Apply the proposed workaround by updating the package.json generation to include dependencies from params.missingSpecs, as this has been tested and verified to resolve the crash loop issue.