[BUG] packages that are in devDependencies AND optionalDependencies are automatically added to package.json's dependencies on npm install

[davidmurdoch]

Current Behavior:

Packages that are in devDependencies AND optionalDependencies are automatically added to package.json's dependencies on npm install.

Expected Behavior:

npm install shouldn't edit the package.json.

npm v6 docs states that Entries in optionalDependencies will override entries of the same name in dependencies, so it’s usually best to only put in one place. (https://docs.npmjs.com/files/package.json#optionaldependencies)

Steps To Reproduce:

1. npm init -y
2. npm install noop --save-optional
3. npm install
4. view package.json and see that the optional dependency was added to dependencies.

Environment:

• OS: Kubuntu 20.04
• Node: 14.13.0
• npm: 7.0.0-rc.0

[feross]

I am noticing this same issue on npm 7.0.6, except it happens for packages with are only in optionalDependencies.

[davidje13]

See also #2203, #724

As noted by feross, the actual bug here is that all optionalDependencies get copied to dependencies. They don't need to also be in devDependencies for this to manifest.

This is a regression in the NPM 7.x line, caused by a large-scale rewrite which performs a mistaken normalisation step when loading the file, then saves its current (now normalised) view back out. Somebody made a PR (npm/normalize-package-data#110) to resolve the optionalDeps -> deps normalisation specifically, but since that normalisation is used in many places it may have other unintended consequences. There is more detailed information in the linked issues.

[vegerot]

I am noticing this bug too with optionalDependencies. All of my optionalDependencies are getting moved to dependencies

[ruyadorno]

same as: #724

[xeho91]

Hi, I am not sure whether I should create a new issue, or continue this topic.

I'd like to confirm if this is still an expected behaviour in v9?

In my case, I'd like to have them separated. As in optionalDependencies not being copied to dependencies.
One of the reasons is, in my program I know, these optionalDependencies will not be included in the CI & CD pipeline, because I run the install script with the --omit optional flag. As in:

npm ci --omit optional

While working on a side project, I noticed that a package read-pkg-up which I use to read the nearest package.json file. One of its dependencies uses the normalize-package-data. So, I am receiving false information about what exactly is inside the dependencies, given that the optionalDependencies are being copied here, even when they're not installed (inside the CI & CD pipeline). And it's confusing.