fix(arborist): use a set for bundled-dependency traversal

workspaces/arborist/lib/node.js

@@ -514,20 +514,25 @@ class Node {
     )
   }
 
-  getBundler (path = []) {
+  getBundler (seen = new Set()) {
+    const isArray = Array.isArray(seen)
     // made a cycle, definitely not bundled!
-    if (path.includes(this)) {
+    if (isArray ? seen.includes(this) : seen.has(this)) {
       return null
     }
 
-    path.push(this)
+    if (isArray) {
+      seen.push(this)
+    } else {
+      seen.add(this)
+    }
 
     const parent = this[_parent]
     if (!parent) {
       return null
     }
 
-    const pBundler = parent.getBundler(path)
+    const pBundler = parent.getBundler(seen)
     if (pBundler) {
       return pBundler
     }
@@ -544,7 +549,7 @@ class Node {
     // then they are not bundled.  Ie, installing a package with
     // unmet bundled deps will not cause your deps to be bundled.
     for (const edge of this.edgesIn) {
-      const eBundler = edge.from.getBundler(path)
+      const eBundler = edge.from.getBundler(seen)
       if (!eBundler) {
         continue
       }

workspaces/arborist/test/node.js

@@ -838,6 +838,32 @@ t.test('bundled dependencies logic', t => {
   t.end()
 })
 
+t.test('getBundler preserves explicit array traversal state', t => {
+  const root = new Node({
+    path: '/path/to/root',
+    pkg: {
+      name: 'root',
+      dependencies: { a: '*' },
+      bundleDependencies: ['a'],
+    },
+  })
+  const a = new Node({
+    parent: root,
+    pkg: { name: 'a', version: '1.0.0' },
+  })
+  const visited = []
+  t.equal(a.getBundler(visited), root)
+  t.same(visited, [a, root], 'populates the caller-provided array')
+  t.equal(a.getBundler(visited), null, 'honors nodes already visited')
+  t.same(visited, [a, root], 'does not append already visited nodes')
+  t.equal(a.getBundler(), root, 'default calls have independent traversal state')
+
+  const duplicates = [root, root]
+  t.equal(a.getBundler(duplicates), root)
+  t.same(duplicates, [root, root, a], 'preserves existing array contents and order')
+  t.end()
+})
+
 t.test('move fsChildren when moving to a new fsParent in same root', t => {
   const root = new Node({
     path: '/path/to/root',