npm / npm/cli

[BUG] Parallelizing `npm version` in workspaces results in error

Open
#9,412 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Good First Issue Needs Triage
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
This issue exists in the latest npm version
  • I am using the latest npm
Current Behavior

I run npm version via ultra-runner or xargs in parallel in >40 workspaces.

One or more calls fail because of "invalid" package.json - in one case (so far) package.json even had been cut to zero bytes.

AFAICT, executing npm version in a single workspace calls changeWorkspaces, which in turn reads every package.json inside the mono-repo via mapWorkspaces. Parallel npm version race, so later calls may find a package.json that has been started to convert (and may be temporarily empty).

Expected Behavior

npm version in a single workspace should not access other workspaces.

This is shown by --no-workspaces which works. But I always would need to remember to include it.

Maybe npm version should internally set --no-workspaces.

Steps To Reproduce

I have no explicit repro, but it's simple: have a workspace tree with ~40 or 50 workspaces.
Use ultra-runner or xargs to execute npm version patch --no-git-tag-version

Environment
  • npm: 11.15 (starts with 8, afaict)
  • Node.js: 22/24
  • OS Name: Linux

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the npm version entry point and trace changeWorkspaces and mapWorkspaces to see why a single-workspace operation reads sibling package.json files. Reproduce the race with parallel npm version patch --no-git-tag-version across roughly 40 workspaces, comparing it with --no-workspaces. Done means the single-workspace command no longer accesses other workspaces or encounters partially written package.json files.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
cli, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.