npm / npm/cli

[BUG] dev true is flaky

Open
#6,521 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Needs Triage Release 9.x
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
This issue exists in the latest npm version
  • I am using the latest npm
Current Behavior

when there is same dependency marked as both devDependency and a dependency at the same time, the package-lock.json start become flaky, sometimes it list it with dev: true and some other times it doesn't
which causes conflicts in our repo, because of incorrect changes were made

Expected Behavior

if a package is both dependency and devDependency, not to be marked as "dev": true in the package-lock.json

Steps To Reproduce
  1. generate new nx angular project npx create-nx-workspace
  2. choose angular, then nothing matter, but to be thoroughly I choose these answers standalone, css, yes, no, no`
  3. run npm i multiple times and check after each time if package-lock.json file changed

the cause of the error is @nx/angular see https://github.com/nrwl/nx/issues/6885
it's installed as production dependency instead of dev dependency
you can see here https://github.com/nrwl/nx/blob/master/packages/angular/package.json it has a lot of what normally are dev dependencies as direct dependencies or peer dependencies, very obvious examples are @nx/linter and @nx/jest which are installed as a dev dependencies in the project root package.json

Environment
  • npm: 9.6.7
  • Node.js: v18.16.0
  • OS Name: Windows 11
  • npm config:
; "user" config from C:\Users\rober\.npmrc

script-shell = "C:\\Users\\rober\\AppData\\Local\\Microsoft\\WindowsApps\\Microsoft.PowerShell_8wekyb3d8bbwe\\pwsh.exe"

; node bin location = C:\Program Files\nodejs\node.exe
; node version = v18.16.0
; npm local prefix = C:\Users\rober\WebstormProjects\daemon-process-terminated-reprod
; npm version = 9.6.7
; cwd = C:\Users\rober\WebstormProjects\daemon-process-terminated-reprod\src\app
; HOME = C:\Users\rober

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with npx create-nx-workspace, then run npm i repeatedly and compare the generated package-lock.json files. Read the lockfile generation and dependency-resolution entry points in the npm CLI; done means the same dependency is handled consistently and is not marked dev: true when it is both a dependency and devDependency.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.