Find any path to top in isOnlyDev

[msbit]

When determining whether a node is considered 'only' a development
dependency of the top-level, check whether there are any paths
from the specific node to the top-level through a direct
development dependency of the top-level to avoid issues where the
shortest path from the node to top-level is via a direct
production dependency, thus causing the node to be considered a
production dependency.

This comes into play particularly when issuing:

npm install --only=development

as this will end up in a situation where transitive dependencies
of a development dependency may not be installed.

References

Fixes #1669

[isaacs]

While this is a correct fix to a legitimate flaw, unfortunately the risk of making any changes in the Installer in v6 is just too great at this point. There are too many people relying on these kinds of edge cases and "incorrect" behaviors without realizing it, and we don't want to break their projects in a legacy version.

Primary development is focused right now on the v7 beta. If you have the same problem in that version, then please post an issue and we can discuss the best approach to fixing it. Regardless, I'll take the test case you provided and make sure that v7 does the right thing.

I'm sorry for having to deliver a disappointing response on this PR. I'm sure it wasn't easy to track this down, and I do appreciate the engagement and thoughtfulness that went into this patch.

[msbit]

Thanks @isaacs, I understand the point about existing v6 users depending on the quirks of the existing behaviour.

When you're replicating the tests on arborist, it would be good to also include a test for the transitive issues @tyler-laberge had in #1669 too (if that's not already on your radar 😄 ).