package-lock.json lists @rollup/rollup-linux-x64-gnu in both dependencies and optionalDependencies

[dhalbert]

Claude wrote this:

package.json declares @rollup/rollup-linux-x64-gnu only under optionalDependencies. The root packages[""] block of package-lock.json lists it twice — once under optionalDependencies as ^4.62.4, matching package.json, and once under dependencies as an exact 4.62.4, matching nothing.

package.json      optionalDependencies = ^4.62.4
package-lock.json dependencies         = 4.62.4      <- not declared anywhere in package.json
                  optionalDependencies = ^4.62.4

The consequence is that a plain npm install with any current npm deletes the dependencies line, so every contributor gets a spurious one-line lockfile diff they then have to decide what to do with. That is how this was noticed: an unrelated branch picked it up as unexplained churn.

Where it came from

The duplicate has been there since bb274fe ("Add rollup package", 2024-08-05), which added the optionalDependencies entry to package.json and simultaneously wrote two entries into the lockfile root block — the optionalDependencies one at ^4.20.0, and a dependencies one at "*".

Dependabot has faithfully bumped the stray dependencies copy ever since, most recently in #548 (8f2ad72, 4.62.3 to 4.62.4). It is not doing anything wrong; it is maintaining a line that should not exist.

Suggested fix

Run npm install with a current npm and commit the resulting package-lock.json. On npm 11.17.0 the entire diff is the removal of that one line, so it is easy to review.

Aggravating factor for contributors on Ubuntu

Ubuntu 26.04 ships nodejs 22.22.1 and npm 9.2.0 as separate debs that are not kept in step — Node 22.22.1 bundles npm 10.9.x upstream, and npm 9 went end of life with Node 18. On npm 9.2.0 the same npm install produces a 34 line diff rather than a 1 line one, because npm 9 predates the libc fields that npm 10.4+ writes for platform-specific optional binaries and silently strips them.

CI uses actions/setup-node with Node 24, which carries npm 11.17.0, so a lockfile committed from an Ubuntu default toolchain is a silent downgrade relative to what CI validates. An engines field or a .nvmrc pinning Node 24 would make the mismatch visible to contributors instead of leaving it to be discovered in a diff.