[BUG] `npm prune --omit dev` does not remove dev dependencies

[relu91]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Reading from the documentation, I expect npm prune --omit=dev to remove packages listed in devDependencies from the local disk (if any packages in dependencies do not require them). However, in my project, certain packages clearly listed only in devDependencies (specifically, but not limited to: typescript, lint-staged, release-it) are not being removed when running this command.

Moreover, if I run npm ci --omit=dev, the final list of installed packages differs from the one resulting from npm ci && npm prune --omit=dev. Is this intended? I found it quite surprising...

Expected Behavior

• npm prune --omit=dev removes all the devDependecies
• npm ci && npm prune --omit=dev results in the same directory structure of npm ci

Steps To Reproduce

This is my dependencies and devDependencies (I removed only two private packages) fields:

  "dependencies": {
    "@angular/animations": "^17.3.12",
    "@angular/common": "^17.3.12",
    "@angular/compiler": "^17.3.12",
    "@angular/core": "^17.3.12",
    "@angular/forms": "^17.3.12",
    "@angular/platform-browser": "^17.3.12",
    "@angular/platform-browser-dynamic": "^17.3.12",
    "@angular/platform-server": "^17.3.12",
    "@angular/router": "^17.3.12",
    "@angular/ssr": "^17.3.12",
    "@capacitor-mlkit/barcode-scanning": "^5.4.0",
    "@capacitor/android": "^5.7.5",
    "@capacitor/app": "5.0.7",
    "@capacitor/core": "5.7.5",
    "@capacitor/haptics": "5.0.7",
    "@capacitor/ios": "^5.7.5",
    "@capacitor/keyboard": "5.0.8",
    "@capacitor/status-bar": "5.0.7",
    "@imgly/background-removal-node": "^1.4.5",
    "@ionic/angular": "^7.8.3",
    "@ionic/angular-server": "^8.4.3",
    "compression": "^1.8.0",
    "deepl-node": "^1.17.0",
    "express": "^4.18.2",
    "ionicons": "^7.2.1",
    "ngx-mapbox-gl": "^10.0.0",
    "redis": "^4.7.0",
    "rxjs": "~7.8.0",
    "sharp": "^0.32.6",
    "tslib": "^2.3.0",
    "vanilla-cookieconsent": "^3.1.0",
    "zone.js": "~0.14.2"
  },
  "devDependencies": {
    "@angular-builders/custom-webpack": "^17.0.2",
    "@angular-devkit/build-angular": "^17.3.12",
    "@angular-eslint/builder": "^17.5.3",
    "@angular-eslint/eslint-plugin": "^17.5.3",
    "@angular-eslint/eslint-plugin-template": "^17.5.3",
    "@angular-eslint/schematics": "^17.5.3",
    "@angular-eslint/template-parser": "^17.5.3",
    "@angular/cli": "^17.3.12",
    "@angular/compiler-cli": "^17.3.12",
    "@angular/language-service": "^17.3.12",
    "@angular/localize": "^17.3.12",
    "@capacitor/cli": "5.7.4",
    "@commitlint/cli": "^19.2.1",
    "@commitlint/config-conventional": "^19.1.0",
    "@ionic/angular-toolkit": "^11.0.1",
    "@release-it/conventional-changelog": "^8.0.1",
    "@trivago/prettier-plugin-sort-imports": "^4.3.0",
    "@types/express": "^4.17.17",
    "@types/jasmine": "~5.1.0",
    "@types/mapbox-gl": "^3.4.0",
    "@types/node": "^18.18.0",
    "@typescript-eslint/eslint-plugin": "^6.0.0",
    "@typescript-eslint/parser": "^6.0.0",
    "browser-sync": "^3.0.0",
    "cpx": "^1.5.0",
    "eslint": "^8.57.0",
    "eslint-config-prettier": "^9.1.0",
    "eslint-plugin-import": "^2.29.1",
    "eslint-plugin-jsdoc": "^48.2.1",
    "eslint-plugin-prefer-arrow": "1.2.2",
    "eslint-plugin-prettier": "^5.1.3",
    "husky": "^9.0.11",
    "jasmine-core": "~5.1.0",
    "jasmine-spec-reporter": "~5.0.0",
    "karma": "~6.4.0",
    "karma-chrome-launcher": "~3.2.0",
    "karma-coverage": "~2.2.0",
    "karma-jasmine": "~5.1.0",
    "karma-jasmine-html-reporter": "~2.1.0",
    "lint-staged": "^15.2.2",
    "prettier": "^3.2.5",
    "release-it": "^17.6.0",
    "typescript": "~5.2.2"
  },

Now try:

• npm i
• check node_modules size (it should be around 1Gb)
• npm prune --omit dev
• check again it still 1Gb
• but if you remove the node_modules folder and then do
• npm i --omit dev --ignore-scripts (ignore scripts is there to avoid husky errors)
• the node_modules folder is now ~500 Mb

Environment

• npm: 11.3.0
• Node.js: 22.15.0
• OS Name: Windows (but I reproduced the problem in node:lts-slim)
• System Model Name:
• npm config:

; "user" config from C:\Users\reluc\.npmrc

//gitlab.example.com/api/v4/projects/182717/packages/npm/:_authToken = (protected)
//registry.npmjs.org/:_authToken = (protected)
cache = "E:\\NpmCache"
ham-it-up = false
unicode = false

; node bin location = C:\Program Files\nodejs\node.exe
; node version = v22.15.0
; npm local prefix = E:\Progetti\archeion\customer-app
; npm version = 11.3.0
; cwd = E:\Progetti\archeion\customer-app
; HOME = C:\Users\reluc
; Run `npm config ls -l` to show all defaults.

[kchindam-infy]

Closing: This is not a issue it is working as intended. The --omit=dev flag does not cause npm prune to remove devDependencies. npm prune only removes packages that are not listed in package.json and since devDependencies are listed, they are considered valid.
To exclude devDependencies, use npm install --omit=dev or npm ci --omit=dev instead. Closing as expected behaviour

[DoisKoh]

That's strange, the docs clearly states that it will remove packages listed in devDependencies.

https://docs.npmjs.com/cli/v11/commands/npm-prune#description

If the --omit=dev flag is specified or the NODE_ENV environment variable is set to
production, this command will remove the packages specified in your devDependencies.

Is this an error in the documentation? Also, devDependencies might be required during the building of applications - so npm prune --omit=dev is still useful for cases where you want to prune the node_modules folder down to the production dependencies only after building the application (with a full npm install) right?

[relu91]

Agree here, there is some misunderstanding. I believe that using npm prune --omit=dev is (was?) quite a common practice to reduce the size of Docker images.

[DoisKoh]

At this point, I've resorted to just deleting the node_modules folder after build and then reinstalling it again with npm ci --omit=dev.

[relu91]

At this point, I've resorted to just deleting the node_modules folder after build and then reinstalling it again with npm ci --omit=dev.

Yeah, we do that too.. quite a waste of time but not a big deal... by the way I thing npm ci already deletes the whole node_modules folder so in theory you just need to re-do npm ci --omit=dev.