Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] npm install command automatically pruning packages even when package-lock config is disabled #3906

Closed
1 task done
KochiyaOcean opened this issue Oct 16, 2021 · 7 comments · May be fixed by #3907
Closed
1 task done
Labels
Bug thing that needs fixing Needs Triage needs review for next steps Release 8.x work is associated with a specific npm 8 release

Comments

@KochiyaOcean
Copy link

KochiyaOcean commented Oct 16, 2021

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

When install using install command with package-lock config disabled, the npm will still prune packages automatically and remove packages that did not appears in package-lock.json

Expected Behavior

According to the document https://docs.npmjs.com/cli/v7/using-npm/config#package-lock , the automatically pruning should be disabled when package-lock config is disabled

Steps To Reproduce

  1. Open shell in an empty folder
  2. Run npm install --no-save --package-lock false lodash
  3. The lodash module will be installed in the node_modules folder in the cwd folder, and package-lock.json is not created
  4. Run npm install --no-save --package-lock false underscore
  5. The underscore module will be installed, but the lodash module is removed

Environment

  • OS: Windows 10
  • Node: 16.10.0
  • npm: 8.1.0
@KochiyaOcean KochiyaOcean added Bug thing that needs fixing Needs Triage needs review for next steps Release 8.x work is associated with a specific npm 8 release labels Oct 16, 2021
@ljharb
Copy link
Contributor

ljharb commented Oct 16, 2021

Even without the lockfile, npm has auto-pruned for many years on install. Disabling the lockfile doesn’t and hasn’t ever disabled that pruning behavior.

@KochiyaOcean
Copy link
Author

@ljharb but the document above says that

When package package-locks are disabled, automatic pruning of extraneous modules will also be disabled. To remove extraneous modules with package-locks disabled use npm prune.

And in npm@6 the install command won't prune packages (the behavior changed since npm@7)

@ljharb
Copy link
Contributor

ljharb commented Oct 16, 2021

Interesting, i wasn’t aware of that (and i find that very confusing; I’d want to be able to both enable and disable pruning regardless of my lockfile setting)

@KochiyaOcean
Copy link
Author

KochiyaOcean commented Oct 16, 2021

Yes, a new option to disable automatic pruning might be a better solution.

@neutraali
Copy link

neutraali commented Nov 10, 2021

Yeah, the documentation is definitely confusing here.

For example, if I install multiple path/to/example-package.tgz in one command, those get installed just fine (using --no-save).

BUT if I try installing some local packages afterward (in the same directory, using --no-save), things go haywire and packages get removed.

EDIT: Looks like downgrading to npm@^6.0.0 resolves the issue for now.

@rommni
Copy link

rommni commented Dec 3, 2021

Good job ;)
Waiting this feature to update from 6.x
Hope we can have it merged soon.

@wraithgar
Copy link
Member

The behavior did change in 7, intentionally. Disabling this would probably need to go through the rfc process.

Docs will be updated #4845

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug thing that needs fixing Needs Triage needs review for next steps Release 8.x work is associated with a specific npm 8 release
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants