Ghost Dependency Issue found in yarn pnp

[agarwalvaibhav0211]

Environment

Nitro version: nitro-nightly version 3.0.1-20260127-164246-ef01b092
Node: v22.15.0

Reproduction

N/A

Describe the bug

Error: nitro-nightly tried to access nitro, but it isn't declared in its dependencies; this makes the require call ambiguous and unsound.    

Required package: nitro (via "nitro/meta")
Required by: nitro-nightly@virtual 

Error: nitro-nightly tried to access defu, but it isn't declared in its dependencies; this makes the require call ambiguous and unsound.    

Required package: defu(via "defu")
Required by: nitro-nightly@virtual 

Additional context

https://github.com/nitrojs/nitro/blob/main/src/build/vite/plugin.ts#L22

https://github.com/nitrojs/nitro/blob/main/src/build/vite/plugin.ts#L24

These are the packages causing issues, and are not included in the dependencies.

Ideally defu should be added to the dependencies. Also, all the files under nitro package should be accessed using relative paths import, rather than module imports, since nightly will not be able to access nitro package

Logs

[pi0]

Please provide a minimal reproduction 🙏🏼

[pi0]

Also make sure to follow this guide when using nightly: https://v3.nitro.build/docs/nightly (it should be "nitro": "npm:... in package.json)

[agarwalvaibhav0211]

Hi @pi0, have added a repro: https://github.com/[agarwalvaibhav0211/yarn-nitro-bug-repro](https://github.com/agarwalvaibhav0211/yarn-nitro-bug-repro).

Ghost dependencies issues are there in regular nitro as well.
So Far, I've been able to identify the following ghost dependencies:

      "defu": "^6.1.4"
      "destr": "^2.0.5"
      "ufo": "^1.6.3"
      "hookable": "^6.0.1"
      "youch-core": "^0.3.3"
      "youch": "^4.1.0-beta.13"
      "source-map": "^0.7.6"
      "scule": "^1.3.0"
      "rendu": "^0.0.7"
      "croner": "9.1.0"
      "unctx": "2.5.0"
      "get-port-please": "^3.2.0"

[agarwalvaibhav0211]

Hi @pi0, any updates on this issue?

[pi0]

Hi. Sorry i haven't chance to test your repro but if it only fails on yarn, it might be a yarn issue. Nitro bundles dependencies with respect to standard node_modules resolution. We might need a workaround for yarn pnp if possible.

[agarwalvaibhav0211]

Hi @pi0, in this case, yarn's way of doing things is the correct way. It only allows you to import dependencies explicitly defined in package.json. But npm allows you to import transitive dependency. This is an issue, for example, if your downstream dependency removes the package not defined in your package.json from its dependencies, then your code will start breaking.

To resolve this, we just need to add these missing/ghost dependencies in the dependencies in package.json.

Can read up on the issue more at https://yarnpkg.com/features/pnp#ghost-dependencies-protection

[agarwalvaibhav0211]

While we are able to resolve this by declaring package extensions in our project, that's more of a footgun, than a true solution(which would be adding the dependency in nitro's package.json)