[Fix] importType: correctly classify aliases resolving outside package root

Fixes #496.

When a resolver (e.g., webpack, typescript) resolves an aliased import to a
path outside the current package root but NOT in node_modules (e.g., a monorepo
sibling package), `isExternalPath` previously classified it as 'external'
because any path with a relative prefix of '..' was treated as external. This
caused `no-extraneous-dependencies` to report false positives for these imports.

The fix replaces the blanket "outside package root = external" check in
`isExternalPath` with a more targeted approach:
1. Check if the path is under a configured external-module-folder relative to
   the package (preserves existing behavior for local node_modules)
2. For paths outside the package root, check if the external-module-folder
   appears as a path segment (catches hoisted deps in monorepos)

Also updates `isInternalPath` to be the logical complement of `isExternalPath`
for resolved paths, so any successfully resolved path that is not in an
external module folder is correctly classified as 'internal'.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: DukeDeSouth

src/core/importType.js

@@ -64,25 +64,44 @@ function isExternalPath(path, context) {
 
   const { settings } = context;
   const packagePath = getContextPackagePath(context);
+  const folders = settings && settings['import/external-module-folders'] || ['node_modules'];
 
-  if (relative(packagePath, path).startsWith('..')) {
-    return true;
-  }
+  const isOutsidePackage = relative(packagePath, path).startsWith('..');
 
-  const folders = settings && settings['import/external-module-folders'] || ['node_modules'];
   return folders.some((folder) => {
+    // For absolute folder paths in external-module-folders, check directly
+    if (nodeIsAbsolute(folder)) {
+      return !relative(folder, path).startsWith('..');
+    }
+
+    // Check if the resolved path is under this external folder relative to the package
     const folderPath = nodeResolve(packagePath, folder);
-    const relativePath = relative(folderPath, path);
-    return !relativePath.startsWith('..');
+    if (!relative(folderPath, path).startsWith('..')) {
+      return true;
+    }
+
+    // For paths outside the package root (e.g., hoisted deps in a monorepo),
+    // check if the external module folder appears as a path segment in the resolved path.
+    // This detects e.g. /monorepo/node_modules/lodash (hoisted) → external,
+    // but NOT /monorepo/packages/shared/src (a monorepo sibling or alias target).
+    if (isOutsidePackage) {
+      const normalizedPath = path.replace(/\\/g, '/');
+      const cleanFolder = folder.replace(/[/\\]+$/, '');
+      return normalizedPath.includes(`/${cleanFolder}/`);
+    }
+
+    return false;
   });
 }
 
 function isInternalPath(path, context) {
   if (!path) {
     return false;
   }
-  const packagePath = getContextPackagePath(context);
-  return !relative(packagePath, path).startsWith('../');
+  // A resolved path that is not classified as external is internal.
+  // This correctly handles aliases and monorepo siblings that resolve to paths
+  // outside the package root but are not in any external module folder (e.g., node_modules).
+  return !isExternalPath(path, context);
 }
 
 function isExternalLookingName(name) {

tests/files/alias-outside-package/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "alias-outside-package",
+  "version": "0.0.0",
+  "private": true
+}

tests/src/core/importType.js

@@ -91,6 +91,19 @@ describe('importType(name)', function () {
     expect(importType('@/does-not-exist', pathContext)).to.equal('unknown');
   });
 
+  it("should return 'internal' for aliases that resolve outside the package root but not in node_modules", function () {
+    // Simulates a monorepo or workspace scenario where an alias resolves to a sibling package.
+    // The resolved path is OUTSIDE the current package root (alias-outside-package/)
+    // but is NOT in node_modules — it should be classified as 'internal', not 'external'.
+    const alias = { 'my-alias': path.join(pathToTestFiles, 'internal-modules') };
+    const webpackConfig = { resolve: { alias } };
+    const aliasContext = {
+      getFilename() { return testFilePath('alias-outside-package/foo.js'); },
+      settings: { 'import/resolver': { webpack: { config: webpackConfig } } },
+    };
+    expect(importType('my-alias/api/service', aliasContext)).to.equal('internal');
+  });
+
   it("should return 'parent' for internal modules that go through the parent", function () {
     expect(importType('../foo', context)).to.equal('parent');
     expect(importType('../../foo', context)).to.equal('parent');

tests/src/rules/no-extraneous-dependencies.js

@@ -188,6 +188,27 @@ ruleTester.run('no-extraneous-dependencies', rule, {
         },
       },
     }),
+
+    // Alias that resolves outside the current package root but not in node_modules.
+    // Simulates a monorepo sibling package accessed via a webpack alias.
+    // The alias target (internal-modules/) is outside alias-outside-package/'s root.
+    test({
+      code: 'import "my-alias/api/service";',
+      filename: testFilePath('alias-outside-package/foo.js'),
+      settings: {
+        'import/resolver': {
+          webpack: {
+            config: {
+              resolve: {
+                alias: {
+                  'my-alias': testFilePath('internal-modules'),
+                },
+              },
+            },
+          },
+        },
+      },
+    }),
   ],
   invalid: [
     test({