sf update fails on macOS arm64 in 2.128.5 with vendored npm/arborist ERR_INVALID_ARG_TYPE

[mdegoll]

Summary

On macOS arm64, sf update in Salesforce CLI 2.128.5-a46a541 fails during the post-check plugin install/reconcile step, even when the CLI is already on the current version.

This looks like a bug in the vendored npm/arborist code path that sf update uses. I was able to reproduce it repeatedly outside my project context and narrow it to @npmcli/arborist/lib/arborist/reify.js inside the bundled npm shipped with the CLI.

There was an initial stale-directory symptom (ENOTEMPTY while renaming @salesforce/analytics), but even after clearing those directories and rebuilding ~/.local/share/sf/node_modules from scratch, sf update still failed with ERR_INVALID_ARG_TYPE.

Steps To Reproduce

1. Use Salesforce CLI @salesforce/cli/2.128.5 on macOS arm64.
2. Run:

sf update

Expected Result

sf update should either:

• exit cleanly if already on the latest version, or
• update/reconcile bundled user plugins without error.

Actual Result

After printing release notes, the command fails in the bundled npm step. I saw two related failures while reproducing:

npm error code ERR_INVALID_ARG_TYPE
npm error The "from" argument must be of type string. Received undefined

with stack frames pointing to:

.../node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js:1198:21
... at [rollbackMoveBackRetiredUnchanged]

and after working around that locally, a second failure:

npm error code ERR_INVALID_ARG_TYPE
npm error The "paths[0]" argument must be of type string. Received undefined

with stack frames pointing to:

.../node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js:1168:26
... at [moveBackRetiredUnchanged]

The failing sf update command was invoking:

npm-cli.js install @salesforce/analytics@latest sfdmu@latest @salesforce/lwc-dev-mobile@latest @salesforce/sfdx-plugin-lwc-test@1.2.1 @salesforce/plugin-code-analyzer@5.10.2 --omit dev --no-audit --loglevel=notice --no-fund

System Information

@salesforce/cli/2.128.5 darwin-arm64 node-v22.22.1

sf path on this machine:

/usr/local/bin/sf -> /usr/local/lib/sf/bin/sf

Bundled npm reported:

npm  v10.9.4

Additional Context

I confirmed this was not project-specific. The failure happened from an unrelated working directory and from the user-level Salesforce CLI install area under:

~/.local/share/sf

I also confirmed that after a full rebuild of ~/.local/share/sf/node_modules, the plugin inventory was healthy, but sf update still failed in the vendored arborist reify/unretire logic.

Temporary Local Workaround

I was able to get sf update to complete by patching the vendored file:

~/.local/share/sf/client/2.128.5-a46a541/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js

Specifically, I added guards in both code paths so they skip entries where rollback/unretire metadata is missing instead of calling path.relative(...) or path.resolve(...) with undefined values.

In practice, guards like this were enough:

if (!realFolder || !retireFolder || !node.path) {
  return Promise.resolve()
}

and

if (!realFolder || !node.path) {
  return Promise.resolve()
}

After that local patch, sf update exited successfully.

Possible Direction

This may be an upstream npm/arborist issue exposed by the CLI’s bundled npm, but it is user-visible through sf update, so a fix here could be:

• updating the bundled npm/arborist version, or
• carrying a defensive guard in the vendored version until upstream is resolved.

There is an older npm issue that looks related to the same arborist failure family:
npm/cli#4907