Wrong versions of dependencies copied when building with electron-builder 26.4.0 and 26.6.0

[appdevopts]

Description:
My project depends on jsdom and markdown-it, both of which have entities as a transitive dependency, but they specify different versions.

jsdom -> parse5 -> entities@^6.0.0
markdown-it -> entities@^4.4.0

When I build this package using an older electron-builder(26.0.12), its directory tree is

node_modules
  |_ entities@6.0.1
  |_ jsdom
  |_ markdown-it
        |_node_modules
             |_ entities@4.5.0
  |_ parse5

But, after I upgrade electron-builder to 26.4.0/26.6.0, its directory tree is

node_modules
  |_ entities@4.5.0
  |_ jsdom
       |_ node_modules
            |_ parse5
  |_ markdown-it
        |_node_modules
             |_ entities@4.5.0
  |_ parse5
        |_node_modules
             |_ entities@6.0.1

I think the second one is wrong, jsdom->parse5 will use the wrong version of entities@4.5.0

I have uploaded a repo to reproduce:
https://github.com/appdevopts/test-electron-builder.git

[mmaietta]

Found the offending commit, but a revert ironically breaks another fix. Will try to get this resolved asap

[mmaietta]

electron-builder@26.7.0

~/D/test-electron-builder> jq '.version' dist/mac-arm64/TestBuilder.app/Contents/Resources/app/node_modules/parse5/package.json
"8.0.0"
~/D/test-electron-builder> jq '.version' dist/mac-arm64/TestBuilder.app/Contents/Resources/app/node_modules/entities/package.json
"6.0.1"
~/D/test-electron-builder> jq '.version' dist/mac-arm64/TestBuilder.app/Contents/Resources/app/node_modules/markdown-it/node_modules/entities/package.json
"4.5.0"

[appdevopts]

@mmaietta Thanks you very much for your quick fix.

I have also verified version 26.7.0, and it works well.
However, I noticed several differences compared to the 26.0.12 build, which has a simpler dependencies directory tree and lower disk usage.

electron-builder @26.7.0

# list all entities packages
jq -r '"entities@" + .version + "\t" + input_filename' node_modules/**/entities/package.json

entities@4.5.0  node_modules/entities/package.json
entities@4.5.0  node_modules/markdown-it/node_modules/entities/package.json
entities@6.0.1  node_modules/parse5/node_modules/entities/package.json

entities@4.5.0 is duplicated.

# list all parse5 packages
jq -r '"parse5@" + .version + "\t" + input_filename' node_modules/**/parse5/package.json

parse5@8.0.0    node_modules/jsdom/node_modules/parse5/package.json
parse5@8.0.0    node_modules/parse5/package.json

parse5@8.0.0 is also duplicated.

# list all packages which have entities dependency
jq -r '                                                                                     
  select(.dependencies.entities?) |
  "dependencies.entities@" + .dependencies.entities + "\t" + .name + "@" + .version + "\t" + input_filename
' node_modules/**/package.json

dependencies.entities@^6.0.0    parse5@8.0.0    node_modules/jsdom/node_modules/parse5/package.json
dependencies.entities@^4.4.0    markdown-it@14.1.0      node_modules/markdown-it/package.json
dependencies.entities@^6.0.0    parse5@8.0.0    node_modules/parse5/package.json

electron-builder @26.0.12

# list all entities packages
jq -r '"entities@" + .version + "\t" + input_filename' node_modules/**/entities/package.json

entities@6.0.1  node_modules/entities/package.json
entities@4.5.0  node_modules/markdown-it/node_modules/entities/package.json

# list all parse5 packages
jq -r '"parse5@" + .version + "\t" + input_filename' node_modules/**/parse5/package.json

parse5@8.0.0    node_modules/parse5/package.json

# list all packages which have entities dependency
jq -r '                                                                                     
  select(.dependencies.entities?) |
  "dependencies.entities@" + .dependencies.entities + "\t" + .name + "@" + .version + "\t" + input_filename
' node_modules/**/package.json

dependencies.entities@^4.4.0    markdown-it@14.1.0      node_modules/markdown-it/package.json
dependencies.entities@^6.0.0    parse5@8.0.0    node_modules/parse5/package.json

[appdevopts]

@mmaietta Thanks you very much for your quick fix.

I have also verified version 26.7.0, and it works well. However, I noticed several differences compared to the 26.0.12 build, which has a simpler dependencies directory tree and lower disk usage.

electron-builder @26.7.0

# list all entities packages
jq -r '"entities@" + .version + "\t" + input_filename' node_modules/**/entities/package.json

entities@4.5.0  node_modules/entities/package.json
entities@4.5.0  node_modules/markdown-it/node_modules/entities/package.json
entities@6.0.1  node_modules/parse5/node_modules/entities/package.json

entities@4.5.0 is duplicated.

# list all parse5 packages
jq -r '"parse5@" + .version + "\t" + input_filename' node_modules/**/parse5/package.json

parse5@8.0.0    node_modules/jsdom/node_modules/parse5/package.json
parse5@8.0.0    node_modules/parse5/package.json

parse5@8.0.0 is also duplicated.

# list all packages which have entities dependency
jq -r '                                                                                     
  select(.dependencies.entities?) |
  "dependencies.entities@" + .dependencies.entities + "\t" + .name + "@" + .version + "\t" + input_filename
' node_modules/**/package.json

dependencies.entities@^6.0.0    parse5@8.0.0    node_modules/jsdom/node_modules/parse5/package.json
dependencies.entities@^4.4.0    markdown-it@14.1.0      node_modules/markdown-it/package.json
dependencies.entities@^6.0.0    parse5@8.0.0    node_modules/parse5/package.json

electron-builder @26.0.12

# list all entities packages
jq -r '"entities@" + .version + "\t" + input_filename' node_modules/**/entities/package.json

entities@6.0.1  node_modules/entities/package.json
entities@4.5.0  node_modules/markdown-it/node_modules/entities/package.json

# list all parse5 packages
jq -r '"parse5@" + .version + "\t" + input_filename' node_modules/**/parse5/package.json

parse5@8.0.0    node_modules/parse5/package.json

# list all packages which have entities dependency
jq -r '                                                                                     
  select(.dependencies.entities?) |
  "dependencies.entities@" + .dependencies.entities + "\t" + .name + "@" + .version + "\t" + input_filename
' node_modules/**/package.json

dependencies.entities@^4.4.0    markdown-it@14.1.0      node_modules/markdown-it/package.json
dependencies.entities@^6.0.0    parse5@8.0.0    node_modules/parse5/package.json

Unfortunately, after further investigation, the dependency tree in the new version is still incorrect.

The dependencies looks like this:
node_modules/jsdom -> node_modules/jsdom/node_modules/parse5@8.0.0 -> node_modules/entities@4.5.0

But, node_modules/jsdom/node_modules/parse5@8.0.0 should have a dependency entities@^6.0.0