issue 10999

npm3/10999/README.md

@@ -0,0 +1,43 @@
+# npm3 - #10999 - Npm v3 non-determinism does actually result in different code (not just tree structure)
+
+Original bug can be found here: [#10999](https://github.com/npm/npm/issues/10999).
+With npm 3, for the first time other packages can influence each other's dependencies.
+
+## Up and Running
+
+```
+$ npm install test-b --save
+$ npm install test-a --save
+$ node index.js
+```
+
+This will print:
+
+```
+1.0.0
+1.0.1
+```
+
+Now let's try the opposite order:
+
+```
+$ rm -rf node_modules # just restore things to their previous state
+$ git checkout package.json # just restore things to their previous state
+$ npm install test-a --save
+$ npm install test-b --save
+$ node index.js
+```
+
+This will print:
+
+```
+1.0.0
+```
+
+# Explanation
+
+As you can see, install order actually affects the bits that will be run. The key here is that test-a has an *absolute dependency* on test-c 1.0.0, while test-b has a semver range dependency on test-c ^1.0.0. That means if test-b is installed first, it correctly picks up 1.0.1, then a will of course want 1.0.0. However, if a installs first, then 1.0.0 will be installed, which satisfies b, and thus both get 1.0.0.
+
+The important thing here is that anyone *ELSE* that has an absolute dependency (and is alphabetically before you), effectively sabotages YOUR package. The only remedy is then on the *end user* to manually fiddle with thier shrinkwrap. As a package author, you can't actually do anything, other than explain to your users the subtle effects *other packages* have on your package, then try to walk them through their each time unique shrinkwrap solution.
+
+Edit: I'd like to quickly point out that I'm not making a claim to the require-cache. I could have had it print "good" and "bad" instead of "1.0.0" and "1.0.1". I am aware that there is no guarantee of getting two 1.0.0's or just 1 depending on the tree structure.

npm3/10999/index.js

@@ -0,0 +1,3 @@
+
+require("test-a");
+require("test-b");

npm3/10999/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "10999",
+  "version": "1.0.0",
+  "description": "With npm 3, for the first time other packages can influence each other's dependencies.",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "author": "",
+  "license": "ISC"
+}