npm / npm/cli

[BUG] Production installations resolves development dependencies

Open
#4,967 4 comments 42 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Needs Triage Release 8.x
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
This issue exists in the latest npm version
  • I am using the latest npm
Current Behavior

When npm installs the dependencies from package.json with the flag --production it tries to resolve the other dependencies as well but than cause the installation to fail with an error because the dependencies might not be available in the environment.

An example: You have some private build tools in you devDependencies that aren't required for running the project in production and are also not available.

Expected Behavior

Installation with --production should only resolve the necessary dependencies and ignore the other ones.

Steps To Reproduce
  1. Setup package.json
  2. Install private package as dev dependency
  3. Log out from registry – so that you aren't able to access the private package anymore (or use an environment in which you aren't logged in)
  4. Remove node_modules if needed
  5. Run npm install --production
Environment
  • npm: 8
  • Node.js: 16
  • OS Name: macOS / Amazon Linux 2

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the failure with a package.json containing an inaccessible private devDependency, then run npm install --production as described. Trace the production dependency-resolution path and verify that installation succeeds without attempting to resolve unavailable devDependencies.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
cli, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.