[BUG] --lockfile-version is not respected when using shrinkwrap and hidden lockfile #3962

dominykas · 2021-10-29T07:00:11Z

Is there an existing issue for this?

I have searched the existing issues

Current Behavior

$ npm shrinkwrap --lockfile-version=2 produces a v3 lockfile.

v8.1.1 used to print a warning, but #3949 changed that.

v8.1.2 just produces a v3 lockfile without any warnings.

Expected Behavior

lockfile-version param/config should be respected.

Steps To Reproduce

$ rm -rf npm-shrinkwrap.json (if the shrinkwrap exists - it seems to work OK)
$ npm shrinkwrap --lockfile-version=2
$ cat npm-shrinkwrap.json | jq .lockfileVersion

Actual: 3
Expected: 2

Environment

OS: macOS 11.6
Node: 14.18.1
npm: 8.1.2

The text was updated successfully, but these errors were encountered:

dominykas · 2021-10-29T07:01:20Z

(removed - this didn't actually work as I described it)

lukekarrys · 2021-10-29T18:17:45Z

@dominykas I can't reproduce this. Here's what I'm seeing:

❯ cat package.json
{
  "name": "3962",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "volta": {
    "node": "14.18.1",
    "npm": "8.1.2"
  }
}

❯ npm --version
node 8.1.2

❯ node --version
v14.18.1

❯ ls -lha
total 4.0K
drwxr-xr-x  3 lukekarrys staff   96 Oct 29 11:16 .
drwxr-xr-x 45 lukekarrys staff 1.5K Oct 29 11:13 ..
-rw-r--r--  1 lukekarrys staff  278 Oct 29 11:13 package.json

❯ npm shrinkwrap --lockfile-version=2
npm notice created a lockfile as npm-shrinkwrap.json

❯ cat npm-shrinkwrap.json| json .lockfileVersion
2

❯ ls -lha
total 8.0K
drwxr-xr-x  4 lukekarrys staff  128 Oct 29 11:14 .
drwxr-xr-x 45 lukekarrys staff 1.5K Oct 29 11:13 ..
-rw-r--r--  1 lukekarrys staff  195 Oct 29 11:14 npm-shrinkwrap.json
-rw-r--r--  1 lukekarrys staff  278 Oct 29 11:13 package.json

ljharb · 2021-10-29T18:37:15Z

@lukekarrys off topic, but what is json? Typically jq is what’s used there; I’ve never seen that one before.

lukekarrys · 2021-10-29T18:41:11Z

what is json

It's this package from the registry: https://www.npmjs.com/package/json. It does less than jq but I tend to use it for simple npm examples since it's easier to install.

ljharb · 2021-10-29T18:45:00Z

Gotcha; that seems unwise since most people already have jq available and know what it is :-) (that package is not highly used) maybe if the examples used npx it’d be clearer?

lukekarrys · 2021-10-29T18:54:12Z

maybe if the examples used npx it’d be clearer?

I agree that it should be made clearer and thanks for the reminder since this already come up in our docs: npm/documentation#45

I'm still leaning towards npx json over jq since I want to have as few prerequisites as possible. But we can discuss more over there :)

dominykas · 2021-10-30T13:34:46Z

Are you sure you had no lockfile to start with?

lukekarrys · 2021-10-30T18:00:52Z

Are you sure you had no lockfile to start with?

Yes, that's why I showed the output from the initial ls -lha to confirm that. Can you check your .npmrc files? npm config get lockfile-version should show if you have that set somewhere.

dominykas · 2021-10-31T08:24:03Z

Oh, yeah, sorry, I missed the ls.

I experimented a little more. I was able to see the behavior you're seeing on an empty folder, however when I ran npm i before the npm shrinkwrap, I got the version 3.

~~I'm not 100% sure I was able to repro that consistently, so I'll try a little more.~~ Upd: able to repro consistently, I think:

✔ ~/devel/experiments/shrinkwrap 
10:27 $ npm --version
8.1.2

✔ ~/devel/experiments/shrinkwrap 
10:27 $ node --version
v14.18.1

✔ ~/devel/experiments/shrinkwrap 
10:27 $ npm config get lockfile-version
null

✔ ~/devel/experiments/shrinkwrap 
10:27 $ ls -al
total 8
drwxr-xr-x   3 dominykas  staff   96 31 Oct 10:27 .
drwxr-xr-x  10 dominykas  staff  320 31 Oct 10:24 ..
-rw-r--r--   1 dominykas  staff  237 31 Oct 10:27 package.json

✔ ~/devel/experiments/shrinkwrap 
10:27 $ cat package.json 
{
  "name": "3962",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "private": true
}

✔ ~/devel/experiments/shrinkwrap 
10:27 $ npm shrinkwrap --lockfile-version=2
npm notice created a lockfile as npm-shrinkwrap.json

✔ ~/devel/experiments/shrinkwrap 
10:27 $ cat npm-shrinkwrap.json | jq .lockfileVersion
2

✔ ~/devel/experiments/shrinkwrap 
10:28 $ rm npm-shrinkwrap.json 

✔ ~/devel/experiments/shrinkwrap 
10:28 $ npm i lodash

added 1 package, and audited 2 packages in 884ms

found 0 vulnerabilities

✔ ~/devel/experiments/shrinkwrap [0] 
10:28 $ npm shrinkwrap --lockfile-version=2
npm notice created a lockfile as npm-shrinkwrap.json

✔ ~/devel/experiments/shrinkwrap [0] 
10:28 $ cat npm-shrinkwrap.json | jq .lockfileVersion
3

✔ ~/devel/experiments/shrinkwrap [0] 
10:28 $ cat node_modules/.package-lock.json | jq .lockfileVersion
2

(that last one I find a bit interesting)

lukekarrys · 2021-11-01T20:13:06Z

Do you have package-lock=false set anywhere? I can only replicate your results if I do npm i lodash --package=lock=false. I think this is still a bug, but I'm trying to nail down the exact scenario.

Here's my full results (without package-lock=false):

❯ ls -al
total 4
drwxr-xr-x  3 lukekarrys staff   96 Nov  1 13:04 .
drwxr-xr-x 45 lukekarrys staff 1440 Oct 29 11:13 ..
-rw-r--r--  1 lukekarrys staff  218 Nov  1 13:04 package.json

❯ cat package.json
{
  "name": "3962",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC"
}

❯ npm i lodash

added 1 package, and audited 2 packages in 1s

found 0 vulnerabilities

❯ npm shrinkwrap --lockfile-version=2
npm notice package-lock.json has been renamed to npm-shrinkwrap.json

❯ cat npm-shrinkwrap.json | npx json .lockfileVersion
2

❯ cat node_modules/.package-lock.json | npx json .lockfileVersion
2

And if I do --package-lock=false:

❯ npm i lodash --package-lock=false

added 1 package, and audited 2 packages in 1s

found 0 vulnerabilities

❯ npm shrinkwrap --lockfile-version=2
npm notice created a lockfile as npm-shrinkwrap.json

❯ cat npm-shrinkwrap.json | npx json .lockfileVersion
3

❯ cat node_modules/.package-lock.json | npx json .lockfileVersion
2

dominykas · 2021-11-01T20:15:19Z

Yes, I do have it set globally.

lukekarrys · 2021-11-01T20:17:18Z

Thanks! I updated the issue title to more accurately reflect what's happening and can confirm this is a bug that we should fix.

lukekarrys · 2021-11-02T14:54:26Z

I also found that when update a shrinkwrap file, we sometimes show a message with the incorrect lockfile version, even if the file did get updated correctly.

❯ ls -lha
total 12K
drwxr-xr-x  5 lukekarrys staff  160 Nov  2 07:47 .
drwxr-xr-x 46 lukekarrys staff 1.5K Nov  2 01:37 ..
-rw-r--r--  1 lukekarrys staff  648 Nov  2 07:47 package-lock.json
-rw-r--r--  1 lukekarrys staff  266 Nov  2 07:45 package.json

❯ cat package-lock.json | npx json .lockfileVersion
2

❯ npm shrinkwrap --lockfile-version=3
npm notice package-lock.json has been renamed to npm-shrinkwrap.json

❯ npm shrinkwrap --lockfile-version=3
npm notice npm-shrinkwrap.json updated to version 2

❯ cat npm-shrinkwrap.json | npx json .lockfileVersion
3

Fix: #3962 When created from a hidden lockfile, shrinkwrap was always setting the lockfileVersion to 3. The shrinkwrap command also needed to be updated to log the correct message based on the lockfileVersion config instead of the static lockfileVersion. With these fixes, it was possible to log a better message whenever we are changing the lockfileVersion, either from a config or any existing lockfile. Lastly, the tests for shrinkwrap were completely refactored to use the real npm and test all conceivable scenarios, as well as removing usage of `util.promisify` in favor of `fs.promises` now that we've dropped support for Node 10.

dominykas · 2021-11-05T07:49:28Z

🙇

dominykas added Bug thing that needs fixing Needs Triage needs review for next steps Release 8.x work is associated with a specific npm 8 release labels Oct 29, 2021

dominykas mentioned this issue Oct 29, 2021

fix: allow --lockfile-version config to be string and coerce to number #3949

Merged

lukekarrys added Awaiting Information further information is requested and removed Needs Triage needs review for next steps labels Oct 29, 2021

lukekarrys removed the Bug thing that needs fixing label Oct 30, 2021

lukekarrys self-assigned this Nov 1, 2021

lukekarrys added Bug thing that needs fixing Priority 1 high priority issue and removed Awaiting Information further information is requested labels Nov 1, 2021

lukekarrys changed the title ~~[BUG] --lockfile-version is not respected~~ [BUG] --lockfile-version is not respected when using shrinkwrap and hidden lockfile Nov 1, 2021

lukekarrys mentioned this issue Nov 3, 2021

fix: shrinkwrap setting incorrect lockfileVersion #3978

Merged

wraithgar closed this as completed in e5bfdac Nov 4, 2021

lukekarrys mentioned this issue Apr 12, 2022

[BUG] node_modules/.package-lock.json contains lockfileVersion 2 instead of 3 #3971

Open

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[BUG] --lockfile-version is not respected when using shrinkwrap and hidden lockfile #3962

[BUG] --lockfile-version is not respected when using shrinkwrap and hidden lockfile #3962

dominykas commented Oct 29, 2021 •

edited

dominykas commented Oct 29, 2021 •

edited

lukekarrys commented Oct 29, 2021

ljharb commented Oct 29, 2021

lukekarrys commented Oct 29, 2021

ljharb commented Oct 29, 2021

lukekarrys commented Oct 29, 2021

dominykas commented Oct 30, 2021

lukekarrys commented Oct 30, 2021 •

edited

dominykas commented Oct 31, 2021 •

edited

lukekarrys commented Nov 1, 2021

dominykas commented Nov 1, 2021

lukekarrys commented Nov 1, 2021

lukekarrys commented Nov 2, 2021

dominykas commented Nov 5, 2021

[BUG] --lockfile-version is not respected when using shrinkwrap and hidden lockfile #3962

[BUG] --lockfile-version is not respected when using shrinkwrap and hidden lockfile #3962

Comments

dominykas commented Oct 29, 2021 • edited

Is there an existing issue for this?

Current Behavior

Expected Behavior

Steps To Reproduce

Environment

dominykas commented Oct 29, 2021 • edited

lukekarrys commented Oct 29, 2021

ljharb commented Oct 29, 2021

lukekarrys commented Oct 29, 2021

ljharb commented Oct 29, 2021

lukekarrys commented Oct 29, 2021

dominykas commented Oct 30, 2021

lukekarrys commented Oct 30, 2021 • edited

dominykas commented Oct 31, 2021 • edited

lukekarrys commented Nov 1, 2021

dominykas commented Nov 1, 2021

lukekarrys commented Nov 1, 2021

lukekarrys commented Nov 2, 2021

dominykas commented Nov 5, 2021

dominykas commented Oct 29, 2021 •

edited

dominykas commented Oct 29, 2021 •

edited

lukekarrys commented Oct 30, 2021 •

edited

dominykas commented Oct 31, 2021 •

edited