René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Package map subpath resolves outside the target package directory","articleBody":"### Version\n\nv26.5.0\n\n### Platform\n\n```text\n\n```\n\n### Subsystem\n\nmodule\n\n### What steps will reproduce the bug?\n\n``` json\n  // package-map.json\n  {\n    \"packages\": {\n      \"app\": { \"url\": \"./app\", \"dependencies\": { \"dep\": \"dep\" } },\n      \"dep\": { \"url\": \"./dep\", \"dependencies\": {} }\n    }\n  }\n```\n``` js\n  // app/index.js\n  require('dep/../../secret.js');\n```\n`  node --experimental-package-map ./package-map.json app/index.js`\n\n\n### How often does it reproduce? Is there a required condition?\n\nalways\n\n### What is the expected behavior? Why is that the expected behavior?\n\nResolution should fail with ERR_INVALID_MODULE_SPECIFIER, because the subpath escapes the target package's own directory (dep) as declared in the package map.\n\n\n### What do you see instead?\n\nThe specifier resolves successfully to a file outside the target package directory.\n\n\n### Additional information\n\n_No response_","author":{"url":"https://github.com/islandryu","@type":"Person","name":"islandryu"},"datePublished":"2026-08-23T10:39:19Z","url":"https://github.com/nodejs/node/issues/65501"}