npm / npm/cli

[BUG](arborist) explicit requests should not ever be omitted

Open
#4,275 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Priority 2 ws:arborist
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

What / Why

If reifying with { omit: ['optional'], add: ['optional-dep'] }, then optional-dep (and its transitive dependencies) should be added, even though they are optional.

When

$ cat package.json
{
  "optionalDependencies": {
    "abbrev": ""
  }
}

$ cat .npmrc
optional=false

$ npm i abbrev --no-save

up to date, audited 1 package in 392ms

found 0 vulnerabilities

$ npm ls
install-optional@ /Users/isaacs/dev/npm/cli/fixtures/install-optional
└── UNMET OPTIONAL DEPENDENCY abbrev@

Via: @jamesmgreene

Slack discussion:

that's.... a tiny bit tricky, but it's a legit bug. workaround, of course, is install esm with --include=optional --include=dev --include=peer just to be on the safe side, probably?
the "tiny bit tricky" part is that we apply requests and omissions at two different points. when we apply requests, it's a modification to the effective manifest/edges from the root node (or workspace node(s) if specified).
We process omissions later, by knocking out everything with the omitted flag, so any node marked optional: true will be removed before reifying.
Since the explicit request might have some deps which also have the flag, we have to build out the subtree of any explicitly requested nodes, and protect all of those from omission.
I'll write this up in a bug.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in the arborist reification flow and trace how requests modify the root or workspace manifest and edges. Then follow the later omission processing that removes nodes marked optional. Done means an explicitly requested optional dependency and its transitive dependencies remain present despite omit: ['optional'].

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
cli, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.