[BUG] `npm audit --production` reports linked packages' dev deps
Open
Nobody has claimed this yet.
Bug
Priority 2
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
This is not just a request to bump a dependency for a CVE
- This is not solely a request to bump a dependency for a CVE
Current Behavior
- Find a package
foowherenpm auditfails. - Run
npm link. - Go to another project that depends on
foowherenpm audit --production(ornpm audit --omit=dev) succeeds - Run
npm link foo - Run
npm audit --production - It fails, reporting on foo's vulnerable dev deps.
Expected Behavior
It should ignore dev deps of dependencies whether they're link:ed in or not.
Steps To Reproduce
See "current behavior"
Environment
- npm: 11.16.0, and also 12.0.0-pre.1
- Node.js: 26.3.0
- OS Name: Mac
- System Model Name: MBP
- npm config: n/a
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the behavior with npm link foo, then compare npm audit --production and npm audit --omit=dev for linked and unlinked dependencies. Trace the npm CLI audit and dependency-resolution paths involved; done means linked dependencies' dev dependencies are omitted consistently with ordinary dependencies and the regression is covered by tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100