Fix npm package uploads with unexpected structures

For example, when bundledDependencies is set to `false`

ee/app/services/packages/create_dependency_service.rb

@@ -17,7 +17,7 @@ module Packages
     private
 
     def create_dependency(type)
-      return unless dependencies.key?(type)
+      return unless dependencies[type].is_a?(Hash)
 
       names_and_version_patterns = dependencies[type]
       existing_ids, existing_names = find_existing_ids_and_names(names_and_version_patterns)

ee/changelogs/unreleased/198471-npm-dependencies-uploads-with-bundledependencies-false.yml

+---
+title: Fix npm package uploads when bundleDependencies is set to false
+merge_request: 24355
+author:
+type: fixed

ee/spec/services/packages/create_dependency_service_spec.rb

@@ -4,7 +4,7 @@ require 'spec_helper'
 describe Packages::CreateDependencyService do
   describe '#execute' do
     let_it_be(:namespace) {create(:namespace)}
-    let_it_be(:version) { '1.0.1'.freeze }
+    let_it_be(:version) { '1.0.1' }
     let_it_be(:package_name) { "@#{namespace.path}/my-app".freeze }
 
     context 'when packages are published' do
@@ -89,6 +89,25 @@ describe Packages::CreateDependencyService do
             .and change { Packages::DependencyLink.count }.by(1)
         end
       end
+
+      context 'with a dependency not described with a hash' do
+        let(:invalid_dependencies) { dependencies.tap { |d| d['bundleDependencies'] = false } }
+
+        subject { described_class.new(package, invalid_dependencies).execute }
+
+        it 'creates dependencies and links' do
+          expect(Packages::Dependency)
+              .to receive(:ids_for_package_names_and_version_patterns)
+              .once
+              .and_call_original
+
+          expect { subject }
+            .to change { Packages::Dependency.count }.by(1)
+            .and change { Packages::DependencyLink.count }.by(1)
+          expect(dependency_names).to match_array(%w(express))
+          expect(dependency_link_types).to match_array(%w(dependencies))
+        end
+      end
     end
   end
 end