npm / npm/cli

[BUG] npm install command without specific dependency re-orders entire lockfile

Open
#2,635 7 comments 13 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Priority 2 Release 7.x
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Current Behavior:

When running npm install with no specific dependency listed package-lock.json gets updated and the ordering of dependencies is changed. This causes us to constantly be accidentally committing changes to this file when there are in-fact, no changes.

It also makes it incredibly difficult to properly see how things have changed over time, and introduces another fun event, which is that running npm install @sentry/browser@latest (or any package) will then cause the lockfile to get re-ordered and it returns to alphabetical order in the dependency listing (and thus re-arranges all of the lockfile.

Expected Behavior:

I would expect that running npm install without a dependency would not modify the lockfile to be randomly ordered unless it was actually updating a dependency.

Steps To Reproduce:
  1. Run npm install and see that the lockfile changes order.
  2. Run npm install some-dependency and see that package-lock.json returns to it's initial ordering with the new dependency injected as expected.
  3. Run npm install again and see package-lock.json changes ordering again.
Environment:

OS: macOS Big Sur (11.1)
node: 15.8.0
npm: 7.5.1 7.5.6

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the ordering changes with npm 7.5.6 using the listed npm install steps and inspect the resulting package-lock.json. Then trace the npm CLI lockfile handling involved in installs with and without a dependency. Done means an install with no dependency changes leaves lockfile ordering unchanged, while dependency updates still produce the expected lockfile changes and regression coverage verifies both cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
cli, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.