[BUG] npm install command without specific dependency re-orders entire lockfile
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Current Behavior:
When running npm install with no specific dependency listed package-lock.json gets updated and the ordering of dependencies is changed. This causes us to constantly be accidentally committing changes to this file when there are in-fact, no changes.
It also makes it incredibly difficult to properly see how things have changed over time, and introduces another fun event, which is that running npm install @sentry/browser@latest (or any package) will then cause the lockfile to get re-ordered and it returns to alphabetical order in the dependency listing (and thus re-arranges all of the lockfile.
Expected Behavior:
I would expect that running npm install without a dependency would not modify the lockfile to be randomly ordered unless it was actually updating a dependency.
Steps To Reproduce:
- Run
npm installand see that the lockfile changes order. - Run
npm install some-dependencyand see thatpackage-lock.jsonreturns to it's initial ordering with the new dependency injected as expected. - Run
npm installagain and seepackage-lock.jsonchanges ordering again.
Environment:
OS: macOS Big Sur (11.1)
node: 15.8.0
npm: 7.5.1 7.5.6
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the ordering changes with npm 7.5.6 using the listed npm install steps and inspect the resulting package-lock.json. Then trace the npm CLI lockfile handling involved in installs with and without a dependency. Done means an install with no dependency changes leaves lockfile ordering unchanged, while dependency updates still produce the expected lockfile changes and regression coverage verifies both cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- cli, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100