npm / npm/cli

[BUG] v11.6.1 fails to install optionalDependencies of inner package (even if build works)

Open
#8,628 8 comments 11 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Needs Triage
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
This issue exists in the latest npm version
  • I am using the latest npm
Current Behavior

If we have two packages, for example,
package child:

{
  "name": "child-package-repro",
  "version": "1.0.3",
  "optionalDependencies": {
    "pg": "^8.16.3"
  }
}

and package parent:

{
  "name": "parent-package",
  "version": "1.0.0",
  "dependencies": {
    "child-package-repro": "1.0.3"
  }
}

When npm install on the parent package, if it contains a package-lock.json (generated with previous versions) with the optionalDependency (which is marked as optional) it will completely remove the pg dependency. More over, this worked fine in v11.6.0 and before.

Expected Behavior

The optional dependency pg should be installed in parent/node_modules/child-package/node_modules/pg (or hoisted to parent/node_modules/pg).

Steps To Reproduce

With this package: https://github.com/otaviojacobi/npm-cli-repro

  1. Inside the parent directory run:
  2. npm install
  3. npm ls pg will result with:
❯ npm ls pg
parent-package@1.0.0 /home/repro/parent
└── (empty)

While if you install with any previous version of npm (11.6.0 or lower):

❯ npm ls pg
parent-package@1.0.0 /home/repro/parent
└─┬ child-package-repro@1.0.3
  └─┬ pg@8.16.3
    └─┬ pg-pool@3.10.1
      └── pg@8.16.3 deduped

My understanding is that this issue is coming from https://github.com/npm/cli/pull/8579 which is causing a optionalDependency to be removed from the final tree.

Environment

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked npm-cli-repro repository: run npm install in the parent directory and compare npm ls pg with npm 11.6.0 and earlier. Read the behavior introduced by npm/cli pull request 8579, then verify that the child package's optional pg dependency remains installed or hoisted and appears in npm ls pg.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
cli, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.