[BUG] Workspace packages are installed with `--workspaces=false` if root package has no dependencies

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

When installing with npm install --workspaces=false, if the root package has no dependencies (neither dependencies nor devDependencies then the --workspaces=false is ignored and the workspace packages are installed.

Please note that I encountered this behavior while developing a reproducible example for #6690, so they may be related, but this seemed like a distinct issue so I decided to report separately (please feel free to close if it turns out to be related to the same root cause).

Expected Behavior

I would expect the --workspaces=false flag to ignore all workspaces and install ONLY dependencies and devDependencies provided in the root package.json.

Steps To Reproduce

1. Create the following project containing a package.json at the project root and one workspace:

Project structure:

.
+-- package.json
`-- workspace-a
    `-- package.json

./package.json contents:

{
    "name": "npm-workspace",
    "dependencies": {},
    "devDependencies": {},
    "workspaces": [
        "workspace-a"
    ]
}

./workspace-a/package.json contents:

{
    "name": "npm-workspace-a",
    "dependencies": {
        "express": "4.18.1"
    }
}

2. Run the following command: npm install --workspaces=false

In this case, I would not expect any modules to be installed since workspaces should be ignored and there are no dependencies listed in the root project.json file. However, when I run this command, express and its dependencies are installed.

3. To demonstrate correct behavior, if you alter the root package.json to include a package:

./package.json contents:

{
    "name": "npm-workspace",
    "dependencies": {
        "inherits": "2.0.4"
    },
    "devDependencies": {},
    "workspaces": [
        "workspace-a"
    ]
}

Running npm install --workspaces=false will now only install the inherits package (and express will not be installed).

Environment

• npm: 9.8.1
• Node.js: v18.16.0
• OS Name: macOS
• System Model Name: Macbook Pro

Start with the root and workspace-a package.json files and reproduce the behavior using npm install --workspaces=false. Compare the install result when the root has no dependencies with the case where it includes inherits; done means the flag consistently excludes workspace-a dependencies while installing only root dependencies.