[BUG] dedupe not deduplicating some packages at all, some packages only partly or inconsistently

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

find . -type d -name components -path "*/@wordpress/components"
./node_modules/@types/wordpress__edit-post/node_modules/@wordpress/components
./node_modules/@wordpress/media-utils/node_modules/@wordpress/components
./node_modules/@wordpress/components
./node_modules/@wordpress/admin-ui/node_modules/@wordpress/components
./node_modules/@wordpress/dataviews/node_modules/@wordpress/components
./node_modules/@wordpress/reusable-blocks/node_modules/@wordpress/components
./node_modules/@wordpress/patterns/node_modules/@wordpress/components
./node_modules/@wordpress/commands/node_modules/@wordpress/components
./node_modules/@wordpress/plugins/node_modules/@wordpress/components
./node_modules/@wordpress/fields/node_modules/@wordpress/components
./node_modules/@wordpress/editor/node_modules/@wordpress/components
./node_modules/@wordpress/global-styles-ui/node_modules/@wordpress/components
./node_modules/@wordpress/block-editor/node_modules/@wordpress/components
./node_modules/@wordpress/preferences/node_modules/@wordpress/components
./node_modules/@wordpress/interface/node_modules/@wordpress/components
./node_modules/@wordpress/server-side-render/node_modules/@wordpress/components

and npm ls "@wordpress/components"

├─┬ @types/wordpress__blocks@12.5.18
│ └── @wordpress/components@27.6.0
└─┬ @types/wordpress__edit-post@8.4.2
├── @wordpress/components@28.13.0
└─┬ @wordpress/editor@14.36.0
├─┬ @wordpress/block-editor@15.9.0
│ └── @wordpress/components@30.9.0
├─┬ @wordpress/commands@1.36.0
│ └── @wordpress/components@30.9.0
├── @wordpress/components@30.9.0
├─┬ @wordpress/dataviews@11.0.0
│ └── @wordpress/components@30.9.0
├─┬ @wordpress/fields@0.28.0
│ └── @wordpress/components@30.9.0
├─┬ @wordpress/global-styles-ui@1.3.0
│ └── @wordpress/components@30.9.0
├─┬ @wordpress/interface@9.21.0
│ ├─┬ @wordpress/admin-ui@1.4.0
│ │ └── @wordpress/components@30.9.0
│ └── @wordpress/components@30.9.0
├─┬ @wordpress/media-utils@5.36.0
│ └── @wordpress/components@30.9.0
├─┬ @wordpress/patterns@2.36.0
│ └── @wordpress/components@30.9.0
├─┬ @wordpress/plugins@7.36.0
│ └── @wordpress/components@30.9.0
├─┬ @wordpress/preferences@4.36.0
│ └── @wordpress/components@30.9.0
├─┬ @wordpress/reusable-blocks@5.36.0
│ └── @wordpress/components@30.9.0
└─┬ @wordpress/server-side-render@6.12.0
└── @wordpress/components@30.9.0

When checking other installed packages with npm ls, it shows deduped correctly or mostly correctly, e.g. npm ls date-fns (however seems to not be 100% correct either, since it's deduped mostly but I still have it like 4 times)

Expected Behavior

Dedupe should actually remove duplicates

This is especially relevant for large packages.
Unfortunately, this bug affects lots of people without them realizing - IDEs and CIs often have large artificial configs (e.g. phpstorm) for their type checks/LSP and the failure to dedupe unnecessarily increases startup (indexing) time as well as memory consumption.

Steps To Reproduce

{
  "dependencies": {
    "@types/wordpress__block-library": "^2.6.3",
    "@types/wordpress__block-serialization-spec-parser": "^3.1.3",
    "@types/wordpress__blocks": "^12.5.18",
    "@types/wordpress__custom-templated-path-webpack-plugin": "^1.4.6",
    "@types/wordpress__customize-browser": "^5.5.5",
    "@types/wordpress__edit-post": "^8.4.2",
    "@types/wordpress__library-export-default-webpack-plugin": "^1.3.5",
    "@types/wordpress__viewport": "^5.5.3",
    "@types/wordpress__wordcount": "^2.4.5"
  }
}

Run (used --no to quiet all irrelevant output)

npm install --install-links --no-bin-links --no-audit --no-fund --prefer-dedupe
npm dedupe --install-links --no-bin-links --no-audit --no-fund
npm prune --install-links --no-bin-links --no-audit --no-fund

Environment

• npm: 11.7.0
• Node.js: v20.19.6
• OS Name: rocky linux 9
• npm config:

; "global" config from /usr/etc/npmrc

prefix = "/usr"
update-notifier = false

; node bin location = /usr/bin/node
; node version = v20.19.6
; npm local prefix = /path/to/repo
; npm version = 11.7.0
; cwd = /path/to/repo
; HOME = /home/my-user
; Run `npm config ls -l` to show all defaults.

Reproduce the issue with the provided package.json and the npm install, npm dedupe, and npm prune commands, then compare the results with npm ls for @wordpress/components and date-fns. Trace the npm dedupe command's dependency-resolution path and add coverage for the reported nested-package case; done means duplicates are removed consistently without breaking the dependency tree.