Webpack cache is not invalidated properly after updating one dependency

Bug report

What is the current behavior?

When using webpack cache, I get contaminated build after updating one of dependencies. Specifically, my project has a git dependency, after updating commit ref webpack seems to “merge” old one and new one.

If the current behavior is a bug, please provide the steps to reproduce.

I tried to construct minimal reproducing example for this, but my sample project seem to work fine, but main project does not.

What I do:

1. Have my project depend on git+https://git.server.local/repo#old-branch-name
2. In my webpack.config.js I configure ts-loader + babel-loader, asking them to work on dependent repo:

    module: {
        rules: [{
            test:    /\.tsx?$/,
            // also process TS files from the dependency
            exclude: /node_modules(?!\/REPO)/,
            use: [{
                    loader: 'babel-loader',
                    options: require(path.resolve("babel.config.js")),
            }, {
                loader: 'ts-loader',
                options: {
                    transpileOnly: true,
                },
            }]
        }]
    },
   

3. Build with webpack
4. In that (dependent) repo, I heavily rewrite some files, and rename others (in particular, bunch of index.js to index.ts).
5. Run npm i git+https://git.server.local/repo#NEW-branch-name
6. Build with webpack again

After second build, I actually get a mix of old and new package files from REPO in resulting bundle: one of the new index.ts files imports another module, but webpack actually inserts OLD code for OLD index.js from that module. That old code does not even exist in node_modules/REPO anymore.

If I remove node_modules/.cache/webpack and run build again, I get only NEW code in the bundle.

What is the expected behavior?

webpack should detect that REPO was updated and invalidate its cache for that package.

Other relevant information: webpack version: 5.73.0 Node.js version: 16.13.1 Operating System: macOS 12.4 Monterey Additional tools:

    "babel-loader": "^8.2.5",
    "ts-loader": "^9.3.1",
    "typescript": "^4.8.4",

[maksbotan]

Thank you for the answer!

[alexander-akait]

Yes, so you need to use version to detect it, anyway if you have changes in package-json.lock, you can put them in buildDependencies too