bring back --only=dev and --only=prod for npm v7

[isaacs]

npm v7 always installs production deps. There's no way to omit them. We should bring this back, and let you do --omit=prod as well.

[wraithgar]

From #1969 (comment)

Agreed, this is wasteful.

Note for implementer: add a check for the omit settings in the _problemEdges method here: https://github.com/npm/arborist/blob/main/lib/arborist/build-ideal-tree.js#L831

[wraithgar]

from #1969 (comment)

When is use npm install with --only=prod arguments, i just want npm only fetch module in dependencies.
but currently, npm fetch all module information, it's make install process slow.

[isaacs]

Note: if omit includes prod, then we can't just omit all nodes where devOptional/peer are false, because devDeps can depend on production deps. Omitting production is pretty tricky. One approach might be to add yet another flag in calcDepFlags to indicate "yes, I'm production, but I'm a transitive or direct dependency of dev/optional/peer nodes". Otherwise we'll have to walk out from the node's edgesIn to see if there are any non-production nodes in the set.

Updated _problemEdges link: https://github.com/npm/arborist/blob/3b02f76c691def829e7d26ba0d52989a07e37390/lib/arborist/build-ideal-tree.js#L927

Also, since we still have to resolve dev deps for the purpose of building the ideal tree/shrinkwrap, even if they're not being installed, it may be that the "don't fetch devDep manifests in --only=prod mode" is just a wontfix.

[xqin]

If only this is the case(about won't fix), does it mean that if I want to achieve such an effect, I can only delete the corresponding node in package.json before executing npm install?

[xqin]

I have been tracking this issue for many years. If this is the final result (no need to fix), for the npm community, I don't know what to say.

this issue exists since npm v5.10.0 and still exists in npm 7.

[sandstrom]

Ability to install only dev-dependencies, or only production-dependencies, would be great.

What would be even better, is if we could make arbitrary groups in the package.json file, and only install one or several groups. A few group examples would be 'production', 'development', 'linting', 'continuous-integration', …

A good use-case for this is to have a linting group that's only installed during certain CI-runs. On the tree (in package-lock.json, you could have e.g. "groups" : ["dev", "prod", "linting"] instead of the current "dev": true flag.