-
Notifications
You must be signed in to change notification settings - Fork 3.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
dedupe: get deps from shrinkwrap #118
Conversation
(Breaking) side effects include:
It doesn't install packages that are only specified in |
We're going to make sure this doesn't have any unintended consequences and goes in the right direction. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We'd like you to redo the test using our standard test script: see scripts/maketest -- you can give it a directory fixture and it will give you the test setup. It'll help us keep things consistent and avoid some older conventions that aren't effective.
I added the tests, and a doc change now too. I think this change is going to be pretty controversial, seeing how many people already disagree with |
6ca2f43
to
6d0cc95
Compare
db63b89
to
b09bc8c
Compare
06cdf5b
to
f957798
Compare
What's the status of this? The community issue was closed, so I can't ask on that. For me as a Windows user, with my expectation of what The core question I have is: Why is |
@G-Rath I don’t think that’s an issue. Optional dependency should also be locked, so that when the package is installed on another platform, it won’t change the lock file; this way the lock file converges. In contrary, it doesn’t make sense to remove |
@FranklinYu For sure. My question wasn't a challenge at
The point I was wanting to draw attention to with my question is that While I'm sure there's a good reason, in my eyes that highlights a starting point for identifying where |
I think that only refers to packages that work for current platform. For example, since |
Which is fine, except Currently, if I run Currently, if I run Example: Given this
Running
Running
Running
Note that nothing in |
Exactly. The whole point of this PR is that |
Exactly. I've never said otherwise; but it's good we're on the same page 🙂 My question is about the side effect:
I'm interested in why this side effect occurs, given that From my understanding, the worst-case bare minimal solution would be to simply run That's a "fix it in post" style approach - which isn't bad; those kind of fixes are often just far more simpler & maintainable than the alternative: try to "fix" the actual root cause of the problem. This could just be b/c I'm misunderstanding what is meant by "installing any package that is in package-lock.json but not in node_modules", or that just due to the complex nature of npm, that's just how it is, but as I've said: there is at least one way to work around it, that I don't see any major downsides to, given that it seems to give what we all agree is the least astonishing result from running such a command. Eitherway, I'm just generally interested in understanding more about npm works that means that this is a side effect (w/o spending hours taking it apart line by line*) 😄 *: I mean, I'd love to do this, but sadly don't have the time 😂 |
From what I remember (it's been a while),
Since non-installed optional dependencies have no record in the
PS: I think I thought of a third option just now, but I can't think of it anymore so I'll come back to this if the thought does. |
Ah interesting - thanks for the explanation :) Would it be viable to try and leverage the logic that That could be going in the direction you said not spend time trying to do via 2. :) I'm also wondering if there is any to know (or get an idea of) all the possible conditions that can result in a package not being installed but being written to So far I only know of I feel like this strengthens the argument that
To me that sounds like it'll work, depending on how the "trying" is handled; Looking at the error output from doing Which I think boils back down to the first part of this comment, about how does *: Luckly, |
I like option 1. Package lock file should be the source of truth. Everyone knows that |
Plus if you do "need" to modify anything in |
Both depend on |
@FranklinYu any update on this? |
@jpsfs I think you’re mentioning the wrong user. I’m not part of npm team so I can’t merge this even though I want this feature. I haven’t see any npm member involved in discussion by far, so I wouldn’t expect this to happen any time soon. |
@darcyclarke Did you imply that NPM v7 won’t have this issue any more? |
🤖 I have created a release *beep* *boop* --- ## [4.0.4](npm/bin-links@v4.0.3...v4.0.4) (2024-05-04) ### Bug Fixes * [`100a4b7`](npm/bin-links@100a4b7) [npm#117](npm/bin-links#117) linting: no-unused-vars (@lukekarrys) ### Chores * [`e955437`](npm/bin-links@e955437) [npm#117](npm/bin-links#117) bump @npmcli/template-oss to 4.22.0 (@lukekarrys) * [`b602aca`](npm/bin-links@b602aca) [npm#117](npm/bin-links#117) postinstall for dependabot template-oss PR (@lukekarrys) * [`955cc34`](npm/bin-links@955cc34) [npm#116](npm/bin-links#116) bump @npmcli/template-oss from 4.21.3 to 4.21.4 (@dependabot[bot]) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
See https://npm.community/t/3807