[BUG] bundleddepencencies does not bundle dependencies in my monorepo

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

I have a monorepo that is setup similar something like this

• packages
  • main
  • dependency1
  • depencency2

The package.json in the root looks something like this:

{
  "workspaces": [
    "packages/*"
  ]
}

The packages/main/package.json looks something like this

{
  "name": "main",
  "version": "0.0.0",
  "dependencies": {
     "dependency1": "*",
     "dependency2": "*"
  },
  "bundledDependencies": [
    "dependency1",
    "dependency2"
  ]
}

When I do a npm --workspace main pack then dependency1 and dependenc2 are not bundled!

Expected Behavior

I would love to see the dependencies bundled in the package. I have a workaround that does exactly what I want:

the packages/main/package.json:

{
  "name": "main",
  "version": "0.0.0",
  "scripts": {
    "prepack": "./prepack"
  }
  "dependencies": {
     "dependency1": "*",
     "dependency2": "*"
  },
  "bundledDependencies": [
    "dependency1",
    "dependency2"
  ]
}

the packages/main/prepack:

#!/bin/sh

set -e

cd $(dirname $0)

rm --recursive --force node_modules
mkdir --parents node_modules

mkdir --parents .bundle-tmp/dependency1
mkdir --parents .bundle-tmp/dependency2

npm --workspace dependency1 pack --pack-destination .bundle-tmp/dependency1
npm --workspace dependency2 pack --pack-destination .bundle-tmp/dependency2

tar --extract --file .bundle-tmp/dependency1/dependency1-0.0.0.tgz --directory .bundle-tmp/dependency1
tar --extract --file .bundle-tmp/dependency2/dependency2-0.0.0.tgz --directory .bundle-tmp/dependency2

mv .bundle-tmp/dependency1/package node_modules/dependency1
mv .bundle-tmp/dependency2/package node_modules/dependency2

rm --recursive --force .bundle-tmp

for some reason I had to clean the node_modules folder so that only the dependencies i want to be bundled are in there. If i don't it will bundle everything in the node_modules folder. This is kind of weird as i specify what i want in the bundledDependencies key

Steps To Reproduce

Create a monorepo setup with two packages in it. One of the packages is a depencendy of the other. The dependency should be in the bundledDependencies list of the main package. Also, in main package and in the root package include a dependency that has a differnt major value. This will make the package appear in the node modules folder of the main package when installing.

Then npm pack the main packages using the --workspace parameter and voila! the dependent package will nog be in the produces .tgz file.

Environment

• npm:
  10.3.0

• Node.js:
  v21.5.0

• OS Name:
  arch linux

• System Model Name:
  something home made

• npm config:

; "user" config from /home/elmerbulthuis/.npmrc

//registry.npmjs.org/:_authToken = (protected)

; "project" config from /home/elmerbulthuis/workspace/JsonSchema42/.npmrc

commit-hooks = false
git-tag-version = false

; node bin location = /usr/bin/node
; node version = v21.5.0
; npm local prefix = /home/elmerbulthuis/workspace/JsonSchema42
; npm version = 10.3.0
; cwd = /home/elmerbulthuis/workspace/JsonSchema42
; HOME = /home/elmerbulthuis
; Run `npm config ls -l` to show all defaults.

Reproduce the issue with the root and packages/main package.json files and the npm --workspace main pack command. Inspect the generated .tgz contents and compare them with bundledDependencies, including the effect of existing node_modules entries. Done means workspace dependencies listed in bundledDependencies are included without unrelated dependencies being bundled.