fix: always use package key when reading from dependency list instead of package name

[mmaietta]

Fixes: #9580
Fixes: #9560

[changeset-bot]

🦋 Changeset detected

Latest commit: 5174d68

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 8 packages

Name	Type
app-builder-lib	Patch
dmg-builder	Patch
electron-builder-squirrel-windows	Patch
electron-builder	Patch
electron-forge-maker-appimage	Patch
electron-forge-maker-nsis-web	Patch
electron-forge-maker-nsis	Patch
electron-forge-maker-snap	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[Copilot]

Pull request overview

This PR fixes dependency resolution for aliased/renamed dependencies by ensuring dependency graph IDs and stored dependency entries consistently use the dependency list key (the package.json key) rather than the package’s reported from/resolved name, preventing lookup mismatches during node_modules collection and hoisting.

Changes:

• Introduces a shared normalizePackageVersion() helper to generate consistent dependency IDs (${packageKey}@${version}) and override pkg.name to the dependency key.
• Updates npm/pnpm/manual-traversal collectors to use the normalized IDs when building allDependencies and the production dependency graph.
• Adds a changeset for a patch release of app-builder-lib.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
packages/app-builder-lib/src/node-module-collector/traversalNodeModulesCollector.ts	Normalizes dependency IDs using the dependency entry key when collecting and building the production graph.
packages/app-builder-lib/src/node-module-collector/pnpmNodeModulesCollector.ts	Switches production graph traversal to use normalized dependency IDs based on dependency keys; removes packageVersionString() override that used from.
packages/app-builder-lib/src/node-module-collector/npmNodeModulesCollector.ts	Uses normalized dependency IDs/overrides to correctly handle npm aliased dependencies.
packages/app-builder-lib/src/node-module-collector/nodeModulesCollector.ts	Replaces packageVersionString() with normalizePackageVersion() as the shared normalization point.
.changeset/thick-cases-refuse.md	Declares a patch-level changeset for the fix.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.