npm / npm/cli

[BUG] Optional dependencies aren't optional for npm 6 (backwards compat.) if npm 7 regenerates the lock

Open
#3,230 3 comments 9 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Release 7.x
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
Current Behavior

On a system still running npm 6, no install or ci commands can be executed if a dependency has an optional transitive dependency, and the current v2 package-lock.json was generated by npm 7, and package-lock.json has been recreated.

npm 6 would include the optional dependency within package-lock.json's dependencies section with optional: true. npm 7 seems to do this when installing the package originally, but if the lock file is deleted npm 7 then won't do this, but still references the optional dependency within the requires section of other dependencies. When npm 6 comes to install using the lock it can't find the optional dependency and errors out:
image

Expected Behavior

Based on the documentation I can find, npm 7 should (always?) keep a backwards-compatible package-lock.json so that npm 6 can still install dependencies in a mixed project.

Steps To Reproduce
  1. On a system running npm 7, create a project and install jest-haste-map. This has an optional dependency on fsevents but that's Mac only. (Note: I've been running on Windows and Linux, not sure if a Mac would fail to reproduce.)
  2. Delete package-lock.json. We did this because of the mess that mixing npm 6 and 7 did during merges and it was easier to delete the whole file than to resolve Git merge markers.
  3. Run npm install again. npm 7 should regenerate the lock, but it won't have put an entry for fsevents in the parent dependencies object.
  4. Now move to a system running npm 6 with the same project (package.json and the new package-lock.json).
  5. Run npm ci (or even npm install).
  6. See an error about fsevents not being accessible from jest-haste-map.
Environment
  • OS: Windows 10 1909 amd64
  • Node: 12.18.2
  • npm: 7.11.2 (just tested on 7.12.1 too)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue with package.json, a regenerated package-lock.json, jest-haste-map, and its optional fsevents dependency. Compare npm 7.11.2 or 7.12.1 output with npm 6 using install and ci; done means npm 6 can install successfully from the regenerated lockfile.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
cli, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.