fix(arborist): resolve sibling override sets via common ancestor

[manzoorwanijk]

Two bugs combine to cause npm install to silently exit 1 in large monorepos when multiple packages are listed in overrides and share a transitive dependency.

Bug 1 — Sibling override sets treated as conflicting: findSpecificOverrideSet walks parent chains to determine if one override set contains the other. Sibling sets (e.g. the react and react-dom children of the root override set) are never ancestors of each other, so it returned undefined. This left shared transitive deps like loose-envify with an inconsistent override state, eventually causing an ERESOLVE during buildDeps. Fixed by checking haveConflictingRules (which already existed but was not used in this path) and falling back to the nearest common ancestor when the rules are compatible.

Bug 2 — ERESOLVE report crashes with infinite depth: explain-eresolve.js generates the full report file with depth=Infinity. In large trees (especially linked strategy), cycles in the dependency graph (e.g. store nodes referencing each other) cause explainFrom to recurse infinitely, hitting RangeError: Invalid string length. That error is thrown inside the error formatter, which swallows the original ERESOLVE — so you get exit 1 with no message. Fixed by adding cycle detection in explain-dep.js using stack-based seen tracking (add on enter, delete on leave) so diamond dependencies still work but cycles are broken. Also capped report depth to 16. (reverted — depth=Infinity is intentional for the full report file)

Found while testing overrides in WordPress/gutenberg#75814.

References

Fixes #9109

[wraithgar]

This is done on purpose so that the eresolve-report.txt has the full json output. See the comment on line 6.

[manzoorwanijk]

You're right, reverted that change. The depth=Infinity is preserved.

The underlying issue was that in large linked-strategy trees, cycles in the dependency graph (e.g. store nodes referencing each other) caused explainFrom to recurse infinitely, eventually hitting RangeError: Invalid string length.

The fix is now in explain-dep.js instead - added stack-based cycle detection in explainFrom so it breaks out of recursive cycles while still fully expanding diamond dependencies (same node reached via different paths). This way, the full report is still generated as intended, just without infinite recursion.