npm / npm/cli

[BUG] npm ls breaks when private repo dependency uses semver: for version matching

Open
#2,262 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Release 7.x
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Current Behavior:

When package.json contains a private git repository as a dependency with #semver version matching npm ls does not resolve any paths for production or development options. The following error occurs when not using the --silent flag.

verbose stack TypeError: Cannot read property '0' of undefined
4 verbose stack at npa (C:\Program Files\nodejs\node_modules\npm\node_modules\npm-package-arg\npa.js:34:25)
4 verbose stack at doesChildVersionMatch (C:\Program Files\nodejs\node_modules\npm\lib\install\deps.js:61:22)
4 verbose stack at versionMatch (C:\Program Files\nodejs\node_modules\npm\lib\install\deps.js:758:12)
4 verbose stack at Array.filter ()
4 verbose stack at exports.findRequirement (C:\Program Files\nodejs\node_modules\npm\lib\install\deps.js:768:23)
4 verbose stack at findChild (C:\Program Files\nodejs\node_modules\npm\lib\install\deps.js:122:17)
4 verbose stack at computeMetadata (C:\Program Files\nodejs\node_modules\npm\lib\install\deps.js:132:9)
4 verbose stack at C:\Program Files\nodejs\node_modules\npm\lib\ls.js:43:23
4 verbose stack at C:\Program Files\nodejs\node_modules\npm\lib\install\read-shrinkwrap.js:48:14
4 verbose stack at C:\Program Files\nodejs\node_modules\npm\node_modules\iferr\iferr.js:3:64
4 verbose stack at C:\Program Files\nodejs\node_modules\npm\lib\install\read-shrinkwrap.js:33:16
4 verbose stack at tryCatcher (C:\Program Files\nodejs\node_modules\npm\node_modules\bluebird\js\release\util.js:16:23)
4 verbose stack at Promise._settlePromiseFromHandler (C:\Program Files\nodejs\node_modules\npm\node_modules\bluebird\js\release\promise.js:517:31)
4 verbose stack at Promise._settlePromise (C:\Program Files\nodejs\node_modules\npm\node_modules\bluebird\js\release\promise.js:574:18)
4 verbose stack at Promise._settlePromise0 (C:\Program Files\nodejs\node_modules\npm\node_modules\bluebird\js\release\promise.js:619:10)
4 verbose stack at Promise._settlePromises (C:\Program Files\nodejs\node_modules\npm\node_modules\bluebird\js\release\promise.js:699:18)
5 verbose cwd C:\Local Development\Web Projects\MyProject
6 verbose Windows_NT 10.0.19041
7 verbose argv "C:\Program Files\nodejs\node.exe" "C:\Program Files\nodejs\node_modules\npm\bin\npm-cli.js" "ls" "--production=true" "--parseable=true" "--long=false" "--all"
8 verbose node v12.16.1
9 verbose npm v6.13.4
10 error Cannot read property '0' of undefined
11 verbose exit [ 1, true ]

Expected Behavior:

Expect npm ls to output paths when the #semver syntax is not in use.

Steps To Reproduce:
  • In package.json add a private repository to your dependencies. For example:

"dependencies": {
"some-private-library": "git+ssh://git@gitplace.org:example/some-private-library.git#semver:^1.0.0"
}

  • Ensure you have some additional dependencies and devDependencies and then run the following:
    npm ls --production=true --parseable=true --long=false --silent --all
    OR
    npm ls --development=true --parseable=true --long=false --silent --all

You will not get any output from this command unless you remove semver: from the private git repo reference.

Environment:
  • OS: Windows 10.0.19041.0
  • Node: 12.16.1
  • npm: 6.13.4

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with npm/lib/install/deps.js at doesChildVersionMatch and versionMatch, then inspect npm-package-arg/npa.js and the npm/lib/ls.js call path shown in the stack trace. Reproduce with the private git dependency and the provided npm ls production or development commands. Done means npm ls resolves and outputs dependency paths for the #semver reference without the reported TypeError.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
cli, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.