[BUG] dev true is flaky
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
when there is same dependency marked as both devDependency and a dependency at the same time, the package-lock.json start become flaky, sometimes it list it with dev: true and some other times it doesn't
which causes conflicts in our repo, because of incorrect changes were made
Expected Behavior
if a package is both dependency and devDependency, not to be marked as "dev": true in the package-lock.json
Steps To Reproduce
- generate new nx angular project
npx create-nx-workspace - choose angular, then nothing matter, but to be thoroughly I choose these answers
standalone,css,yes,no,no` - run
npm imultiple times and check after each time ifpackage-lock.jsonfile changed
the cause of the error is @nx/angular see https://github.com/nrwl/nx/issues/6885
it's installed as production dependency instead of dev dependency
you can see here https://github.com/nrwl/nx/blob/master/packages/angular/package.json it has a lot of what normally are dev dependencies as direct dependencies or peer dependencies, very obvious examples are @nx/linter and @nx/jest which are installed as a dev dependencies in the project root package.json
Environment
- npm: 9.6.7
- Node.js: v18.16.0
- OS Name: Windows 11
- npm config:
; "user" config from C:\Users\rober\.npmrc
script-shell = "C:\\Users\\rober\\AppData\\Local\\Microsoft\\WindowsApps\\Microsoft.PowerShell_8wekyb3d8bbwe\\pwsh.exe"
; node bin location = C:\Program Files\nodejs\node.exe
; node version = v18.16.0
; npm local prefix = C:\Users\rober\WebstormProjects\daemon-process-terminated-reprod
; npm version = 9.6.7
; cwd = C:\Users\rober\WebstormProjects\daemon-process-terminated-reprod\src\app
; HOME = C:\Users\rober
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue with npx create-nx-workspace, then run npm i repeatedly and compare the generated package-lock.json files. Read the lockfile generation and dependency-resolution entry points in the npm CLI; done means the same dependency is handled consistently and is not marked dev: true when it is both a dependency and devDependency.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100