[BUG] `npm install` removes resolved and integrity fields
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
Sometimes, when npm updates the package-lock.json after a npm install, it replaces some of the "resolved" and "integrity" fields with "license".
Example:
Expected Behavior
npm install should not randomly change the schema of the lockfile.
Steps To Reproduce
I'm still trying to figure out reproduction steps. I think the bug is related to the state of node_modules when npm install is executed.
Environment
- npm: 9.5.0
- Node.js: v18.15.0
- OS Name: macOS 13.3
- System Model Name: Macbook Pro M2
- npm config:
; "user" config from /Users/mzasso/.npmrc
//registry.npmjs.org/:_authToken = (protected)
; "project" config from /project/.npmrc
lockfile-version = "3"
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names npm install and package-lock.json, with npm 9.5.0, Node.js v18.15.0, and lockfile version 3 as the reported setup. Start by reproducing the change while varying the state of node_modules and inspect entries that replace resolved or integrity with license; done means the schema is preserved and the behavior has a regression test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- cli, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100