[Bug]: Monorepo setup causes incorrect externalizing of dependencies

[johnpyp]

Version

System:
    OS: Linux 6.11 Arch Linux
    CPU: (16) x64 AMD Ryzen 7 7800X3D 8-Core Processor
    Memory: 20.45 GB / 61.96 GB
    Container: Yes
    Shell: 5.9 - /usr/bin/zsh
  Browsers:
    Chrome: 132.0.6834.159
  npmPackages:
    @rslib/core: 0.4.1 => 0.4.1

Details

In specific monorepo setups, I think due to symlinks, rslib can mess up the way it externalizes dependencies in bundleless mode. For example, taking this:

import omitBy from "lodash/omitBy";
import isNumber from "lodash/isNumber";
import isOdd from "is-odd";

console.log(omitBy({ a: 1 }, isNumber));
console.log(isOdd(5));

and the imports get strangely transformed into this:

// ...
const omitBy_js_namespaceObject = require("../node_modules/.pnpm/lodash@4.17.21/node_modules/lodash/omitBy.js");
var omitBy_js_default = /*#__PURE__*/ __webpack_require__.n(omitBy_js_namespaceObject);
const isNumber_js_namespaceObject = require("../node_modules/.pnpm/lodash@4.17.21/node_modules/lodash/isNumber.js");
var isNumber_js_default = /*#__PURE__*/ __webpack_require__.n(isNumber_js_namespaceObject);
const index_js_namespaceObject = require("../node_modules/.pnpm/is-odd@3.0.1/node_modules/is-odd/index.js");
var index_js_default = /*#__PURE__*/ __webpack_require__.n(index_js_namespaceObject);
// ...

This happens when using bundle: false, and pnpm hoisting settings:

shared-workspace-lockfile=false
shamefully-hoist=true # this can be removed and the issue still persists

Some things I've tried:

• Removing shared-workspace-lockfile makes the bug stop
• Using bundle: true makes the bug stop
• Explicitly listing all dependencies in externals makes the bug stop
• Removing shamefully-hoist=true does not make the bug stop

Reproduce link

https://github.com/johnpyp/rslib-monorepo-bug-repro

Reproduce Steps

(in the reproduction repository)

1. pnpm install (from root)
2. cd subpkg
3. pnpm build
4. cat dist/cjs/index.js (dist is included in the repo)

[Timeless0911]

This fix will be released around Wednesday of this week.