externalized packages aren't traced properly

Environment

• Operating System: Linux
• Node Version: v18.7.0
• Nitro: latest

Reproduction

https://github.com/mahdiboomeri/nitro-externalized-issue

my older reproduction for context: https://github.com/mahdiboomeri/nuxt3-externalized-issue

Describe the bug

related to https://github.com/nuxt/framework/issues/7105 and #515

When using packages with the same dependency but conflicting versions, the externalized dependency files aren’t traced properly. (sorry if it’s a bit unclear this was the best way i could explain it) for example in the reproduction repo i’m using sharp and jsonwebtoken which both rely on different versions of semver.

I get the following file structure in .output/server/node_modules/semver

- 📂 semver
   - 📂 classes
     - 📄 semver.js
   - 📂 functions
     - 📄 coerce.js
     - 📄 compare.js
     - 📄 gte.js
     - 📄 parse.js
   - 📂 internal
     - 📄 constants.js
     - 📄 debug.js
     - 📄 identifiers.js
     - 📄 parse\-options.js
     - 📄 re.js
   - 📄 package.json

What it should be

- 📂 semver
   - 📂 classes
     - 📄 comparator.js
     - 📄 range.js
     - 📄 semver.js
   - 📂 functions
     - 📄 clean.js
     - 📄 cmp.js
     - 📄 coerce.js
     - 📄 compare\-build.js
     - 📄 compare\-loose.js
     - 📄 compare.js
     - 📄 diff.js
     - 📄 eq.js
     - 📄 gt.js
     - 📄 gte.js
     - 📄 inc.js
     - 📄 lt.js
     - 📄 lte.js
     - 📄 major.js
     - 📄 minor.js
     - 📄 neq.js
     - 📄 parse.js
     - 📄 patch.js
     - 📄 prerelease.js
     - 📄 rcompare.js
     - 📄 rsort.js
     - 📄 satisfies.js
     - 📄 sort.js
     - 📄 valid.js
   - 📂 internal
     - 📄 constants.js
     - 📄 debug.js
     - 📄 identifiers.js
     - 📄 parse\-options.js
     - 📄 re.js
   - 📂 ranges
     - 📄 gtr.js
     - 📄 intersects.js
     - 📄 ltr.js
     - 📄 max\-satisfying.js
     - 📄 min\-satisfying.js
     - 📄 min\-version.js
     - 📄 outside.js
     - 📄 simplify.js
     - 📄 subset.js
     - 📄 to\-comparators.js
     - 📄 valid.js
   - 📄 index.js
   - 📄 package.json
   - 📄 preload.js  

I understand the issue isn’t related to these specific packages, you can find more examples in the https://github.com/nuxt/framework/issues/7105 comments

Additional context

This was partially fixed in #515 but the problem is still there

Logs

No response

[mahdiboomeri]

hi @itpropro Thanks for the further explanation, Based on what you described I think you’re right. I didn’t have much context on #612 other than the reproduction that’s why they sounded different to me i mananged to find some success in fixing the issue with just hacking around, i’m working on a better fix, if it works I probably make a PR

[itpropro]

Hi @mahdiboomeri, I think it’s actually the same issue. The behavior you describe is exactly the same I experienced with e.g. the @azure/identity package. It happens after the build and Nitro throws multiple warning about different versions and that it is picking the newest one. #612 should also be fixed, if all packages are considered for the bundle if they are referenced by a package or a dependency.

EDIT: Here is a updated screenshot from #612 from one of my projects that still throws the warnings with the current nitropack-edge version. I hope we find a fix for this soon 🙌