fix: clone sfdx-project.json deps to avoid writing back to the file

package.json

@@ -90,4 +90,4 @@
   "publishConfig": {
     "access": "public"
   }
-}
+}

src/package/packageVersionCreate.ts

@@ -23,6 +23,7 @@ import { ComponentSetBuilder, ConvertResult, MetadataConverter } from '@salesfor
 import SettingsGenerator from '@salesforce/core/lib/org/scratchOrgSettingsGenerator';
 import * as xml2js from 'xml2js';
 import { PackageDirDependency } from '@salesforce/core/lib/sfProject';
+import { cloneJson } from '@salesforce/kit';
 import * as pkgUtils from '../utils/packageUtils';
 import {
   MDFolderForArtifactOptions,
@@ -371,7 +372,7 @@ export class PackageVersionCreate {
 
     // All dependencies for the packaging dir should be resolved to an 04t id to be passed to the server.
     // (see _retrieveSubscriberPackageVersionId for details)
-    const dependencies = packageDescriptorJson.dependencies;
+    const dependencies = packageDescriptorJson.dependencies ? cloneJson(packageDescriptorJson.dependencies) : [];
 
     // branch can be set via options or descriptor; option takes precedence
     this.options.branch = this.options.branch ?? packageDescriptorJson.branch;

test/package/packageVersionCreate.test.ts

@@ -31,18 +31,33 @@ describe('Package Version Create', () => {
     project = SfProject.getInstance();
     await project.getSfProjectJson().write({
       packageDirectories: [
+        {
+          path: 'pkg',
+          package: 'dep',
+          versionName: 'ver 0.1',
+          versionNumber: '0.1.0.NEXT',
+          default: false,
+          name: 'pkg',
+        },
         {
           path: 'force-app',
           package: 'TEST',
           versionName: 'ver 0.1',
           versionNumber: '0.1.0.NEXT',
           default: true,
           ancestorId: 'TEST2',
+          dependencies: [
+            {
+              package: '[email protected]',
+            },
+          ],
         },
       ],
       packageAliases: {
         TEST: packageId,
         TEST2: '05i3i000000Gmj6XXX',
+        DEP: '05i3i000000Gmj6XXX',
+        '[email protected]': '04t3i000002eyYXXXX',
       },
     });
     await fs.promises.mkdir(path.join(project.getPath(), 'force-app'));
@@ -117,6 +132,12 @@ describe('Package Version Create', () => {
       'SubscriberPackageVersionId',
       'Tag'
     );
+
+    expect(project.getSfProjectJson().getContents().packageDirectories[1].dependencies).to.deep.equal([
+      {
+        package: '[email protected]',
+      },
+    ]);
   });
 
   it('should create the package version create request with codecoverage=true', async () => {