[BUG] npm install never finishes when a dependency has no matching version and two packages peer on it (11.21.1, 12.2.1) #10149

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

Since npm 11.21.1 and 12.2.1, npm install never finishes when a root dependency has no matching version and more than one installed package peers on it. It spins at full CPU instead of failing. npm 11.21.0 and 12.2.0 fail at once with ERESOLVE. The ETARGET that #9987 and #10118 (the fix for #9979) aim for is never reported.

With --loglevel silly the log repeats these three placements without end:

npm silly placeDep ROOT react@ REPLACE for: repro@1.0.0 want: ^999.0.0
npm silly placeDep ROOT react-shallow-renderer@16.15.0 OK for: react-test-renderer@18.2.0 want: ^16.15.0
npm silly placeDep ROOT react@18.3.1 REPLACE for: react-shallow-renderer@16.15.0 want: ^16.0.0 || ^17.0.0 || ^18.0.0

The versionless react@ is the node of the failed fetch of react@^999.0.0. It replaces the react@18.3.1 placed for react-shallow-renderer's peer, which then replaces it again, round after round. The new #loadFailures guard in #loadPeerSet lets both peer conflicts pass, react-dom's and react-test-renderer's. In 11.21.0 the first of them ends the install with ERESOLVE.

Expected Behavior

npm install fails with ETARGET ("No matching version found for react@^999.0.0"), as 11.21.1 already does when only react-dom peers on react.

Steps To Reproduce

1. In an empty directory, create this package.json:

   {
     "name": "repro",
     "version": "1.0.0",
     "dependencies": {
       "react": "^999.0.0",
       "react-dom": "18.2.0",
       "react-test-renderer": "18.2.0"
     }
   }

2. Run npm install --package-lock-only.

3. It does not finish.

The same steps on each release, with an empty cache and user config:

Without react-test-renderer (react-dom alone peering on react), 11.21.1 fails with ETARGET as intended.

#9891 also reports a hang where ETARGET is expected, but it predates 11.21.1 and needs --min-release-age. It may share part of this loop. I have not checked.

Environment

• npm: 11.21.1 and 12.2.1
• Node.js: 24.21.0
• OS Name: macOS (Apple silicon)
• npm config: none (empty HOME and cache)