fix: extendPackage object values should be string

packages/@vue/cli/__tests__/Generator.spec.js

@@ -280,6 +280,30 @@ test('api: warn invalid dep range', async () => {
   })).toBe(true)
 })
 
+test('api: warn invalid dep range when non-string', async () => {
+  const generator = new Generator('/', { plugins: [
+    {
+      id: 'test1',
+      apply: api => {
+        api.extendPackage({
+          dependencies: {
+            foo: null
+          }
+        })
+      }
+    }
+  ] })
+
+  await generator.generate()
+
+  expect(logs.warn.some(([msg]) => {
+    return (
+      msg.match(/invalid version range for dependency "foo"/) &&
+      msg.match(/injected by generator "test1"/)
+    )
+  })).toBe(true)
+})
+
 test('api: extendPackage dependencies conflict', async () => {
   const generator = new Generator('/', { plugins: [
     {

packages/@vue/cli/lib/util/mergeDeps.js

@@ -10,9 +10,10 @@ module.exports = function resolveDeps (generatorId, to, from, sources, forceNewV
   for (const name in from) {
     const r1 = to[name]
     const r2 = from[name]
+    const r2IsString = typeof r2 === 'string'
     const sourceGeneratorId = sources[name]
-    const isValidURI = r2.match(/^(?:file|git|git\+ssh|git\+http|git\+https|git\+file|https?):/) != null
-    const isValidGitHub = r2.match(/^[^/]+\/[^/]+/) != null
+    const isValidURI = r2IsString && r2.match(/^(?:file|git|git\+ssh|git\+http|git\+https|git\+file|https?):/) != null
+    const isValidGitHub = r2IsString && r2.match(/^[^/]+\/[^/]+/) != null
 
     // if they are the same, do nothing. Helps when non semver type deps are used
     if (r1 === r2) continue