npm/npm — pull request #5962 by jandre (2014-08-15 18:55:03+00:00)
Title: Fix `npm dedupe` for private repositories

Fixes an issue where `npm dedupe` does not de-duplicate any private git
repositories.

Consider a tree like this:

- proj/
package.json
node_modules/
proj2/
node_modules/
private_dep
private_dep

Where:

* 'proj/package.json' has a dependency to 'private_dep' that is installed
with path "git+ssh://git@github.com:acct/private_dep.git#0.1.0", e.g.:

"dependencies": {
"private_dep": "git+ssh://git@github.com:acct/private_dep.git#0.1.0"
}

* proj2, which is a dependency of proj, also has a dependency to
private_dep at the same version and path (with the exact same config
in its package.json)

Technically 'private_dep' is the same version, but npm dedupe uses the
version in private_dep/package.json (e.g. 0.1.0) to do the resolution
rather than the path.

This code will use the git paths in node_modules/ package.json and
the calculated '_from' field to do the comparisons:

"_from": "git+ssh://git@github.com:acct/private_dep.git#0.1.0"

** PLEASE VERIFY I AM DOING THIS IN A LOGICAL WAY, NOT SURE IF I HAVE UNTANGLED THE RUBE GOLDBERG MACHINE CORRECTLY **