[BUG] Optional dependencies aren't optional for npm 6 (backwards compat.) if npm 7 regenerates the lock
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Is there an existing issue for this?
- I have searched the existing issues
Current Behavior
On a system still running npm 6, no install or ci commands can be executed if a dependency has an optional transitive dependency, and the current v2 package-lock.json was generated by npm 7, and package-lock.json has been recreated.
npm 6 would include the optional dependency within package-lock.json's dependencies section with optional: true. npm 7 seems to do this when installing the package originally, but if the lock file is deleted npm 7 then won't do this, but still references the optional dependency within the requires section of other dependencies. When npm 6 comes to install using the lock it can't find the optional dependency and errors out:

Expected Behavior
Based on the documentation I can find, npm 7 should (always?) keep a backwards-compatible package-lock.json so that npm 6 can still install dependencies in a mixed project.
Steps To Reproduce
- On a system running npm 7, create a project and install
jest-haste-map. This has an optional dependency onfseventsbut that's Mac only. (Note: I've been running on Windows and Linux, not sure if a Mac would fail to reproduce.) - Delete package-lock.json. We did this because of the mess that mixing npm 6 and 7 did during merges and it was easier to delete the whole file than to resolve Git merge markers.
- Run
npm installagain. npm 7 should regenerate the lock, but it won't have put an entry forfseventsin the parent dependencies object. - Now move to a system running npm 6 with the same project (package.json and the new package-lock.json).
- Run
npm ci(or evennpm install). - See an error about
fseventsnot being accessible fromjest-haste-map.
Environment
- OS: Windows 10 1909 amd64
- Node: 12.18.2
- npm: 7.11.2 (just tested on 7.12.1 too)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue with package.json, a regenerated package-lock.json, jest-haste-map, and its optional fsevents dependency. Compare npm 7.11.2 or 7.12.1 output with npm 6 using install and ci; done means npm 6 can install successfully from the regenerated lockfile.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- cli, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100