aube add drops optional and hasInstallScript from npm package-lock.json entries

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: npm-lock-optional-flag-drop
• aube: 2.8.0 linux-x64 (2026-10-19) (also 2.7.2 and 1.41.0)

The fixture depends only on esbuild@0.25.10. Its package-lock.json comes from npm 11.19.0 (npm install --package-lock-only --ignore-scripts --no-audit --no-fund), and npm 10.8.2 leaves it byte-identical. When aube add is-number@7.0.0 rewrites the lockfile, it removes "optional": true from all 26 @esbuild/* platform packages and "hasInstallScript": true from esbuild, with both the isolated and hoisted node linkers. Running npm install is-number@7.0.0 on npm 10.8.2 or 11.19.0 keeps both flags.

npm 10.8.2 then rejects the aube-written lockfile:

npm error notsup Unsupported platform for @esbuild/aix-ppc64@0.25.10: wanted {"os":"aix","cpu":"ppc64"} (current: {"os":"linux","cpu":"x64"})

npm 11.19.0 npm ci accepts it, but the lockfile no longer records which packages are optional.

NPM_BIN=/path/to/real/npm ./repro.sh

I found this while adding two dev dependencies to an npm project with Node 20 coworkers. There, aube also reordered fields in 163 existing entries and dropped funding.type, so a two-package add produced about 2,300 changed lines where npm added 761.

[jdx]

Thanks for the detailed repro. Confirmed two causes in the npm writer: optional was only computed for packages reachable from a root optionalDependencies entry, so packages behind an optional edge of a regular dependency (esbuild's @esbuild/*) lost the flag, and hasInstallScript was never read or written. The writer now marks packages reached only through optional edges as optional (or devOptional), and hasInstallScript round-trips.

Fix is in #1775, covered by a unit test of a parse/write round trip. I haven't run your repro repo or npm against it. Not addressed yet: the field reordering in existing entries and the dropped funding.type, which account for much of the extra diff you saw.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

[mwolson]

Retested with aube 2.8.1 linux-x64 (2026-10-20):

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: npm-lock-optional-flag-drop

NPM_BIN=/path/to/real/npm ./repro.sh

It now exits 0. aube add is-number@7.0.0 keeps "optional": true on all 26 @esbuild/* entries and "hasInstallScript": true on esbuild with both node linkers, and npm 10.9.4 npm ci accepts the result.

Fix shipped in aube 2.8.1 via #1775. Marking your reply as the answer.

I split the remaining parts you mentioned (field reordering in existing entries and the dropped funding.type) into their own topic, #1810, with a separate minimal repro. It also covers a funding array being reduced to its first URL.