fix: regression in package.json merging logic that caused extraneous packages to not be removed

src/cli/package-install.js

@@ -41,7 +41,7 @@ pkgInstall.updatePackageFile = () => {
 	// Sort dependencies alphabetically
 	dependencies = sortDependencies({ ...dependencies, ...defaultPackageContents.dependencies });
 
-	const packageContents = _.merge(oldPackageContents, defaultPackageContents, { dependencies });
+	const packageContents = { ..._.merge(oldPackageContents, defaultPackageContents), dependencies };
 
 	fs.writeFileSync(paths.currentPackage, JSON.stringify(packageContents, null, 2));
 };

test/package-install.js

@@ -1,6 +1,5 @@
 'use strict';
 
-const { execSync } = require('child_process');
 const path = require('path');
 const fs = require('fs').promises;
 const assert = require('assert');
@@ -27,25 +26,15 @@ describe('Package install lib', () => {
 		});
 
 		it('should remove non-`nodebb-` modules not specified in `install/package.json`', async () => {
-			const oldValue = process.env.NODE_ENV;
-			process.env.NODE_ENV = 'development';
-
-			// install an extra package
-			// chose dotenv because it's a popular package
-			// and we use nconf instead
-			execSync('npm install dotenv --save');
-
-			// assert it saves in package.json
-			const packageWithExtras = JSON.parse(await fs.readFile(packageFilePath, 'utf8'));
-			assert(packageWithExtras.dependencies.dotenv, 'dependency did not save');
+			source.dependencies.dotenv = '16.0.0';
+			await fs.writeFile(packageFilePath, JSON.stringify(source, null, 4));
+			delete source.dependencies.dotenv;
 
-			// update the package file
 			pkgInstall.updatePackageFile();
 
 			// assert it removed the extra package
 			const packageCleaned = JSON.parse(await fs.readFile(packageFilePath, 'utf8'));
 			assert(!packageCleaned.dependencies.dotenv, 'dependency was not removed');
-			process.env.NODE_ENV = oldValue;
 		});
 
 		it('should merge new root level properties from `install/package.json` into `package.json`', async () => {