[BUG](arborist) explicit requests should not ever be omitted
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
What / Why
If reifying with { omit: ['optional'], add: ['optional-dep'] }, then optional-dep (and its transitive dependencies) should be added, even though they are optional.
When
$ cat package.json
{
"optionalDependencies": {
"abbrev": ""
}
}
$ cat .npmrc
optional=false
$ npm i abbrev --no-save
up to date, audited 1 package in 392ms
found 0 vulnerabilities
$ npm ls
install-optional@ /Users/isaacs/dev/npm/cli/fixtures/install-optional
└── UNMET OPTIONAL DEPENDENCY abbrev@
Via: @jamesmgreene
Slack discussion:
that's.... a tiny bit tricky, but it's a legit bug. workaround, of course, is install esm with --include=optional --include=dev --include=peer just to be on the safe side, probably?
the "tiny bit tricky" part is that we apply requests and omissions at two different points. when we apply requests, it's a modification to the effective manifest/edges from the root node (or workspace node(s) if specified).
We process omissions later, by knocking out everything with the omitted flag, so any node marked optional: true will be removed before reifying.
Since the explicit request might have some deps which also have the flag, we have to build out the subtree of any explicitly requested nodes, and protect all of those from omission.
I'll write this up in a bug.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in the arborist reification flow and trace how requests modify the root or workspace manifest and edges. Then follow the later omission processing that removes nodes marked optional. Done means an explicitly requested optional dependency and its transitive dependencies remain present despite omit: ['optional'].
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- cli, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100