Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[BUG] Wrong lock file modification for optional dependency #7530

Open
2 tasks done
kirrg001 opened this issue May 15, 2024 · 2 comments · May be fixed by #7710
Open
2 tasks done

[BUG] Wrong lock file modification for optional dependency #7530

kirrg001 opened this issue May 15, 2024 · 2 comments · May be fixed by #7710
Labels
Bug thing that needs fixing Priority 2 secondary priority issue

Comments

@kirrg001
Copy link

Is there an existing issue for this?

  • I have searched the existing issues

This issue exists in the latest npm version

  • I am using the latest npm

Current Behavior

Lock file is incorrect after updating optional dependency.

Steps to reproduce:

package.json

{
  "name": "prisma-opt",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "optionalDependencies": {
    "prisma": "^5.13.0"
  },
  "author": "",
  "license": "ISC"
}

package-lock.json

{
  "name": "prisma-opt",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "prisma-opt",
      "version": "1.0.0",
      "license": "ISC",
      "optionalDependencies": {
        "prisma": "^5.13.0"
      }
    },

`

I want to update prisma to 5.14.0 running:

npm i prisma@^5.14.0 --save-optional

(I also tried npm i prisma@^5.14.0 and npm i prisma@latest, same behaviour)

package.json (correct)

  "optionalDependencies": {
    "prisma": "^5.14.0"
}

package-lock.json (wrong)

{
  "name": "prisma-opt",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "prisma-opt",
      "version": "1.0.0",
      "license": "ISC",
      "dependencies": {
        "prisma": "5.14.0"
      },
      "optionalDependencies": {
        "prisma": "^5.14.0"
      }
    },

"dependencies": {
"prisma": "5.14.0"
},

Running npm install again (correct)

{
  "name": "prisma-opt",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "prisma-opt",
      "version": "1.0.0",
      "license": "ISC",
      "optionalDependencies": {
        "prisma": "^5.14.0"
      }
    },

Expected Behavior

I do not expect that this change appears in the lock file:

"dependencies": {
"prisma": "5.14.0"
},

Or I do not expect that after npm install the change get's removed.

Steps To Reproduce

See "Current Behavior"

Please note: The steps to reproduce I have shared is a minimal application. This bug appears in my large application with having lot's of dev dependencies and optional dependencies, but we do not have production dependencies.

Environment

  • npm: 10.7.0
  • Node.js: Latest v18 (Also tested latest v22)
  • OS Name: OSX
  • System Model Name:
  • npm config:
; copy and paste output from `npm config ls` here
@kirrg001 kirrg001 added Bug thing that needs fixing Needs Triage needs review for next steps labels May 15, 2024
kirrg001 added a commit to instana/nodejs that referenced this issue May 15, 2024
@kirrg001
build: fixed package-lock.json
eabfbcd 
refs npm/cli#7530
@milaninfy milaninfy added Priority 2 secondary priority issue and removed Needs Triage needs review for next steps labels May 16, 2024
@rahulio96
Copy link
Contributor

rahulio96 commented Aug 7, 2024 •
edited
Loading

Hello,

I spent some time looking into this issue, and it seems like this is intended behavior for when you install a package. According to a comment, optional dependencies are added to production dependencies to support "previous npm versions that require this behaviour."

I'll still open a PR to see how the project maintainers/engineers feel about changing this since it can come off as confusing to the user.

@rahulio96 rahulio96 linked a pull request Aug 8, 2024 that will close this issue
Open
@xan187
Copy link

xan187 commented Aug 15, 2024

yes ty

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bug thing that needs fixing Priority 2 secondary priority issue
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: stop optional dependencies from being added to prod inside lockfile rahulio96/cli
4 participants
@kirrg001 @xan187 @milaninfy @rahulio96