nodejs / nodejs/citgm

npm 12 - drops `npm-shrinkwrap.json`

Open
#1,117 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
606
Forks
157
Avg merge
3d 23h
Merged PRs (30d)
3

Description

Situation

npm 12 drops npm-shrinkwrap.json used in this repo as a published lockfile. The npm 12.0.0 changelog states:

npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.

npm install under npm 12 installs dependencies according to their SemVer range specified in package.json and ignores the lower locked versions specified in npm-shrinkwrap.json.

Example impact

If the repo is cloned and dependencies installed under npm 12, then npm test fails.

npm install ignores the locked prettier@3.6.2 and installs instead prettier@^3.6.2 from package.json which causes prettier@3.9.6 to be installed, and written into the new lockfile package-lock.json.

prettier@3.9.0 introduced formatting improvements which flagged a white space formatting issue in lib/reporter/logger.js that was not previously flagged.

Edit: A workaround for this example impact was implemented through PR https://github.com/nodejs/citgm/pull/1119.

It can potentially impact other dependencies where versions locked in npm-shrinkwrap.json are different from a fresh resolution based on ^x.y.z SemVer ranges in package.json.

Steps to reproduce

Ubuntu 24.04.4 LTS, Node.js 24.19.0, initially with npm 11.17.0

git clone https://github.com/nodejs/citgm
cd citgm
git clean -xfd # if repeating
npm install -g npm@12.0.2
npm install
npm test

Logs

$ npm test
npm notice run citgm@10.0.2 test
npm notice run npm run lint && npm run tap
npm notice run citgm@10.0.2 lint
npm notice run npm run lint:eslint && npm run lint:prettier
npm notice run citgm@10.0.2 lint:eslint
npm notice run eslint . --cache
npm notice run citgm@10.0.2 lint:prettier
npm notice run prettier --check .
Checking formatting...
[warn] lib/reporter/logger.js
[warn] Code style issues found in the above file. Run Prettier with --write to fix.

Suggestion

Review also how this impacts use of citgm when installing using npm install -g citgm as specified in the README > Installation section.

For the Prettier issue, that was used here more as an illustration of compatibility issues, update to latest and fix the formatting.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the npm 12 install and test commands described in the issue, then inspect npm-shrinkwrap.json, package.json, lib/reporter/logger.js, and the README Installation section. Review the workaround in PR 1119 and check whether npm 12 installation and global installation remain supported; done means the dependency behavior is addressed and npm test passes without the reported formatting failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
testing, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.