npm 12 - drops `npm-shrinkwrap.json`
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 606
- Forks
- 157
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 3
Description
Situation
npm 12 drops npm-shrinkwrap.json used in this repo as a published lockfile. The npm 12.0.0 changelog states:
npm shrinkwrapis removed, theshrinkwrapconfig alias is removed, andnpm-shrinkwrap.jsonis no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-rootnpm-shrinkwrap.jsontopackage-lock.json; usebundleDependenciesif you need to ship a locked dependency tree.
npm install under npm 12 installs dependencies according to their SemVer range specified in package.json and ignores the lower locked versions specified in npm-shrinkwrap.json.
Example impact
If the repo is cloned and dependencies installed under npm 12, then npm test fails.
npm install ignores the locked prettier@3.6.2 and installs instead prettier@^3.6.2 from package.json which causes prettier@3.9.6 to be installed, and written into the new lockfile package-lock.json.
prettier@3.9.0 introduced formatting improvements which flagged a white space formatting issue in lib/reporter/logger.js that was not previously flagged.
Edit: A workaround for this example impact was implemented through PR https://github.com/nodejs/citgm/pull/1119.
It can potentially impact other dependencies where versions locked in npm-shrinkwrap.json are different from a fresh resolution based on ^x.y.z SemVer ranges in package.json.
Steps to reproduce
Ubuntu 24.04.4 LTS, Node.js 24.19.0, initially with npm 11.17.0
git clone https://github.com/nodejs/citgm
cd citgm
git clean -xfd # if repeating
npm install -g npm@12.0.2
npm install
npm test
Logs
$ npm test
npm notice run citgm@10.0.2 test
npm notice run npm run lint && npm run tap
npm notice run citgm@10.0.2 lint
npm notice run npm run lint:eslint && npm run lint:prettier
npm notice run citgm@10.0.2 lint:eslint
npm notice run eslint . --cache
npm notice run citgm@10.0.2 lint:prettier
npm notice run prettier --check .
Checking formatting...
[warn] lib/reporter/logger.js
[warn] Code style issues found in the above file. Run Prettier with --write to fix.
Suggestion
Review also how this impacts use of citgm when installing using npm install -g citgm as specified in the README > Installation section.
For the Prettier issue, that was used here more as an illustration of compatibility issues, update to latest and fix the formatting.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the npm 12 install and test commands described in the issue, then inspect npm-shrinkwrap.json, package.json, lib/reporter/logger.js, and the README Installation section. Review the workaround in PR 1119 and check whether npm 12 installation and global installation remain supported; done means the dependency behavior is addressed and npm test passes without the reported formatting failure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- testing, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100