[BUG] `--dry-run` fails with EALLOWREMOTE on registry tarballs for packages that declare bundleDependencies

Is there an existing issue for this?

• I have searched the existing issues

The closest reports have a different cause: #9796 (registry serving tarballs from a path outside the configured registry prefix) and the closed exemption fixes #9494 / #9548 / #9509. This one happens against the default registry.npmjs.org and only under --dry-run. #9187 is a separate --dry-run bug (side effects / output).

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

With npm 12's default allow-remote=none, npm install --dry-run refuses a registry-hosted tarball when the target package — or a package in its graph — declares bundleDependencies:

$ npm i --dry-run npm@11.10.0
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/npm/-/npm-11.10.0.tgz"

The identical command without --dry-run succeeds. The refused URL is a registry.npmjs.org tarball and registry is the default, so the registry-tarball exemption should apply.

@tailwindcss/oxide is the realistic case: it bundles nothing itself, but its optional @tailwindcss/oxide-wasm32-wasi dep declares bundleDependencies — and since that package is cpu: ["wasm32"], a real install skips it entirely, which is presumably why only the dry-run path trips.

Practical impact: npm update --dry-run to preview a bump fails in any project whose tree contains such a package (anything on Tailwind 4, for instance), while the real npm update completes fine. In a monorepo that makes the preview unusable without --allow-remote=all, which is exactly the guard one doesn't want to relax to inspect a change.

Not caused by min-release-age: reproduces with --min-release-age=0 explicitly passed.

Expected Behavior

--dry-run should apply the same registry-tarball allow-remote exemption a real install does. Declaring bundleDependencies shouldn't cause a registry spec to be classified as type remote.

Steps To Reproduce

$ mkdir /tmp/eallowremote && cd /tmp/eallowremote && npm init -y

# both fail with EALLOWREMOTE
$ npm i --dry-run npm@11.10.0
$ npm i --dry-run @tailwindcss/oxide@4.3.3

# both succeed
$ npm i npm@11.10.0
$ npm i @tailwindcss/oxide@4.3.3

# control: no bundleDependencies, dry-run is fine
$ npm i --dry-run lodash@4.17.21

Environment

• npm: 12.0.1
• Node.js: 24.18.0
• OS Name: Linux 7.0.11 (x86_64)
• System Model Name: n/a
• npm config:

; user config (registry auth lines omitted)
min-release-age = 7
min-release-age-exclude = ["@fullbeaker/*"]
registry = "https://registry.npmjs.org/"

; relevant npm 12 defaults, not overridden
allow-remote = "none"
allow-git = "none"