[Bug]: js_binary data deps seem to linger

[paullewis]

What happened?

If I have a js_binary and set something from //:node_modules as a data attribute, a copy of the node_modules still exists in bin even if I subsequently remove it from the data attribute; this in turn means the binary still runs even though it probably shouldn't.

Version

Development (host) and target OS/architectures: Mac

Output of bazel --version: bazel 5.3.2

Version of the Aspect rules, or other relevant rules from your
WORKSPACE or MODULE.bazel file: 1.6.9

Language(s) and/or frameworks involved: JavaScript.

How to reproduce

js_binary(
    name = "server",
    data = [
        # "//:node_modules/express"
    ],
    entry_point = ":server.js",
)

server.js can be as simple as:

const express = require('express');

Any other information?

If you run with express commented out, it will fail to run. Then if you uncomment express in data, all is right with the world and it runs. However, if you run it again with express dep commented out again, express won't be in the server.sh.runfiles, but because there's a copy of the node_modules in the root of bin the js_binary will run unless you bazel clean first.