`--prefix` flag ignores `overrides` from target package.json
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Is there an existing issue for this?
- I have searched the existing issues
Current Behavior
When using npm install <package> --prefix <target-dir> from a different directory, npm correctly:
- Reads
<target-dir>/package.json - Writes dependencies to
<target-dir>/package.json - Installs packages to
<target-dir>/node_modules
However, npm ignores the overrides section from <target-dir>/package.json.
Expected Behavior
If --prefix makes npm use <target-dir>/package.json for reading dependencies and writing new ones, it should also respect the overrides section from that same file.
Steps To Reproduce
- Create a test directory structure:
mkdir -p /tmp/npm-prefix-test/target-dir
mkdir -p /tmp/npm-prefix-test/other-dir
- Create
target-dir/package.jsonwith an override:
{
"name": "override-test",
"version": "1.0.0",
"overrides": {
"ms": "2.0.0"
}
}
- From
other-dir, install a package that depends onms:
cd /tmp/npm-prefix-test/other-dir
npm install debug@4.3.4 --prefix /tmp/npm-prefix-test/target-dir
- Check which version of
mswas installed:
cat /tmp/npm-prefix-test/target-dir/node_modules/ms/package.json | grep version
Result: "version": "2.1.2" (or similar) - override was ignored
- Control test - run from target directory:
cd /tmp/npm-prefix-test/target-dir
rm -rf node_modules package-lock.json
npm install debug@4.3.4
cat node_modules/ms/package.json | grep version
Result: "version": "2.0.0" - override was respected
Environment
- npm: 10.9.2
- Node.js: 22.12.0
- OS: macOS Darwin 25.1.0
Source Code Analysis
Traced through the source code:
lib/commands/install.jscreates Arborist withpath: npm.prefixlib/npm.jsreturnsconfig.localPrefixfor local installsworkspaces/config/lib/index.js-loadLocalPrefix()correctly sets prefix from--prefixCLI flagworkspaces/arborist/lib/arborist/build-ideal-tree.js-#initTree()reads package.json viaPackageJson.normalize(this.path)workspaces/arborist/lib/node.js- loads overrides whenloadOverrides: true
The path is correctly propagated, but somewhere in the chain the overrides from the target package.json are not being applied to the dependency resolution.
Workaround
The only reliable workaround is to cd into the target directory:
(cd /path/to/target && npm install <package>)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue with the documented --prefix commands, then trace lib/commands/install.js, lib/npm.js, workspaces/config/lib/index.js, workspaces/arborist/lib/arborist/build-ideal-tree.js, and workspaces/arborist/lib/node.js. Determine where the target package.json overrides stop being applied and add coverage showing that --prefix installs the overridden dependency version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- cli, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100