Package map subpath resolves outside the target package directory

Version

v26.5.0

Platform

Subsystem

module

What steps will reproduce the bug?

  // package-map.json
  {
    "packages": {
      "app": { "url": "./app", "dependencies": { "dep": "dep" } },
      "dep": { "url": "./dep", "dependencies": {} }
    }
  }

  // app/index.js
  require('dep/../../secret.js');

node --experimental-package-map ./package-map.json app/index.js

How often does it reproduce? Is there a required condition?

always

What is the expected behavior? Why is that the expected behavior?

Resolution should fail with ERR_INVALID_MODULE_SPECIFIER, because the subpath escapes the target package's own directory (dep) as declared in the package map.

What do you see instead?

The specifier resolves successfully to a file outside the target package directory.

Additional information

No response

まず、app/index.js と node --experimental-package-map を使って package-map.json の再現手順を実行します。../../secret.js を含む場合に dep サブパスがどのように解決されるかを追跡し、解決によって dep 外のパスが ERR_INVALID_MODULE_SPECIFIER で拒否されることを確認します。