Skip to content

fix(exec): prevent shared binPaths pollution across workspace runs#9692

Merged
owlstronaut merged 1 commit into
release/v11from
backport/v11/9650
Jun 29, 2026
Merged

fix(exec): prevent shared binPaths pollution across workspace runs#9692
owlstronaut merged 1 commit into
release/v11from
backport/v11/9650

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Backport of #9650 to release/v11.

…9650)

**Description:**
related: #9640

**Bug:**
When running `npm exec` across multiple workspaces, the binary from the
first workspace would accidentally bleed into the second one if they
shared the same name.

**Root Cause:**
In `libnpmexec`, the `binPaths` array was scoped at the module level
instead of inside the `exec()` function. Since `execWorkspaces` runs
everything in a single process, `binPaths` just kept accumulating paths.
When the second workspace ran, the first workspace's `.bin` path was
still sitting at the front of `PATH`, so it hijacked the execution.

**Fix:**
Moved `binPaths` inside `exec()` so it gets a fresh array on every call.
I left the `manifests` map at the module level (keyed by `spec.raw`)
because we still want to cache registry specs across calls, and absolute
paths won't collide anyway.

**Testing:**
- Added a regression test in `test/local.js` with two workspaces using
the exact same local bin name (`shared-bin`).
- Gave each test call its own `args` array to stop `@npmcli/run-script`
from mutating it and hanging the tests.
- Fails correctly without the fix. With the fix, all tests pass 100%.

(cherry picked from commit 18b930f)
@owlstronaut owlstronaut merged commit f3f2465 into release/v11 Jun 29, 2026
33 checks passed
@owlstronaut owlstronaut deleted the backport/v11/9650 branch June 29, 2026 15:10
@github-actions github-actions Bot mentioned this pull request Jun 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants