npm / npm/cli

[BUG] Invalid local dependency file doesn't fail install process

Open
#4,894 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Needs Triage Release 8.x
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
This issue exists in the latest npm version
  • I am using the latest npm
Current Behavior

When running the npm install command, if in the package.json file exists an invalid path for a local dependency file, the install process doesn't fail as expected.
Example: "dependencies": { "json": "file:json" }

If we specify a local dependency file with invalid path but now with extension tar.gz, the install fails and returns an error message.
Example: "dependencies": { "json": "file:json.tar.gz" }

Note: in both cases the path is invalid, so the files don't exist in the project, because when the file exist it is working as expected.

Expected Behavior

The expected results for any kind of non existing file path, when specifing a local dependency file that doesn't exist, would be to fail the install process and return the error message.

Steps To Reproduce
  1. Create an npm project and specify in the package.json file a local dependency file with an invalid path: "dependencies": { "json": "file:json" }.
  2. Run the command npm install.
  3. See that the install process doesn't fail, and no error message is shown.

Otherwise, if an invalid tar.gz file is specified an expected error is presented:

  1. Create an npm project and specify in the package.json file a local dependency file with an invalid path: "dependencies": { "json": "file:json.tar.gz" }.
  2. Run the command npm install.
  3. See that the install process fails as expected, and an error is shown: npm ERR! enoent ENOENT: no such file or directory, open '...\lodash.tar.gz' npm ERR! enoent This is related to npm not being able to find a file..
Environment
  • npm: 8.9.0
  • Node.js: 16.15.0

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the behavior with the package.json dependencies shown and compare the file and tar.gz cases while tracing npm install's local dependency handling. Done means every nonexistent local dependency path fails installation with an error, while existing local files continue to install successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.