Use a traversal-local Set to track visited nodes in Arborist’s getBundler(), while retaining the existing behavior for explicitly supplied arrays.

Why this should reduce work

The existing path array is a visited collection, not a stack: nodes are appended and never popped. Each includes() searches the growing collection again. A dependency shared by many packages can therefore require substantial repeated scanning even though the traversal already avoids revisiting nodes.

A set expresses the same visited-node membership test without those linear searches. This does not change traversal order, bundle selection, or the dependency graph, and does not introduce a persistent cache or invalidation rules.

Compatibility

The optional traversal argument is exposed as an array in the public TypeScript declarations. Explicit arrays therefore continue through the original array operations, including mutation order, existing duplicates, and already-visited behavior. Only normal calls that omit the argument start with a set.

The added regression test covers those array behaviors and verifies that separate default calls have independent traversal state.

Local measurements

I applied this same method change directly to an isolated npm 11.17.0 installation, using Node 24.22.0. These final measurements do not use a preload hook or a CPU profiler.

For a large workspace snapshot with 5,405 original lockfile entries, I updated prettier to 3.9.10 with:

node <npm-installation>/bin/npm-cli.js install prettier@3.9.10 \
  --package-lock-only --ignore-scripts --audit=false --fund=false \
  --timing --force --offline

Each sample started from the same manifests and lockfile, in a fresh directory, with a warmed metadata cache. After one warmup per variant, three measured pairs alternated execution order.

Every resulting lockfile was byte-identical across variants.

A tiny-project control with one local dependency used seven measured alternating pairs, excluding warmups:

Those control differences are effectively noise. These are local native-command measurements, not a claim about every project or complete dependency-update jobs. The large workspace fixture is not included; the public synthetic example below reproduces the eliminated membership-search work without relying on that fixture.

Validation

On this PR’s upstream checkout, using Node 24.22.0:

• node bin/npm-cli.js test --workspace=@npmcli/arborist --ignore-scripts -- --jobs=4 — passed: 59 test files; 100% statements, branches, functions, and lines.
• node node_modules/eslint/bin/eslint.js workspaces/arborist/lib/node.js workspaces/arborist/test/node.js — passed.
• Separate generated-graph differential checks — passed: 300 graphs, 15,000 default-call comparisons, and 15,000 explicit-array comparisons, including node relocation and comparison of the populated arrays.
• The npm CLI-wide test suite was not run.

node <<'JS'
const assert = require('node:assert/strict')
const Node = require('./workspaces/arborist/lib/node.js')

class VisitedArray extends Array {
  lookups = 0
  entriesSearched = 0

  includes (node) {
    const index = super.indexOf(node)
    this.lookups++
    this.entriesSearched += index < 0 ? this.length : index + 1
    return index >= 0
  }
}

class VisitedSet extends Set {
  lookups = 0

  has (node) {
    this.lookups++
    return super.has(node)
  }
}

const names = Array.from({length: 512}, (_, i) => `provider-${i}`)
const root = new Node({
  path: '/synthetic',
  pkg: {
    name: 'root',
    version: '1.0.0',
    dependencies: Object.fromEntries(names.map(name => [name, '*'])),
  },
})
const shared = new Node({
  parent: root,
  pkg: {name: 'shared', version: '1.0.0'},
})
for (const name of names) {
  new Node({
    parent: root,
    pkg: {name, version: '1.0.0', dependencies: {shared: '*'}},
  })
}

const array = new VisitedArray()
const set = new VisitedSet()
assert.equal(shared.getBundler(array), null)
assert.equal(shared.getBundler(set), null)
assert.equal(array.lookups, 1538)
assert.equal(array.entriesSearched, 133889)
assert.equal(set.lookups, 1538)
console.log({
  arrayLookups: array.lookups,
  arrayEntriesSearched: array.entriesSearched,
  setLookups: set.lookups,
})
JS

Prepared with assistance from GitHub Copilot. The validation results above were obtained locally.

References

• Public Arborist TypeScript declarations, which expose getBundler(path?: Node[]).
• No linked issue; this is a standalone performance improvement.