[BUG] npm install --only=dev doesn't install dev modules also present in regular dependencies

[alexkvak]

This issue npm/npm#12184 is still actual.

[xqin]

i have same issue, and npm install has error occurrence.

node version:  v13.5.0
npm version: 6.13.4

POC:

git clone https://github.com/xqin/npm-bug-report
cd npm-bug-report
docker build . -t aa --no-cache

preview:

100% reproduction.

Related discussions:
https://npm.community/t/npm-install-only-prod-verbose-please-do-not-pre-fetch-devdependencies/4732

[ajoslin103]

this is indeed a real issue -- npm -v 6.13.7

the option --only=dev is told to you when you use --dev

but --only=dev does not work

at https://docs.npmjs.com/cli/install the specification is --save-dev which does work

please update the cli error message...

--save-dev works

[cloudratha]

@xqin to me that looks like it's working. --only=dev should only install your devDependencies of which safe-buffer is not in.

Still think it's buggy as I can't for the life of me get rimraf installed with the flag with it in my devDependencies, but found this which helped explain why:

https://npm.community/t/dev-only-only-dev-install-fails-when-module-is-a-dependency-of-multiple-places/2613

Seems like packages in your devDependencies that have dependencies of that same package are not installed.

[ZelphirKaltstahl]

The described behavior is still happening, after multiple years of this bug surfacing again and again. How can this still happen in the default package manager for node modules? It is really baffling.

In my case I have a devDependency, which might be somewhere in the tree of recursive dependencies of my dependencies, but is not immediately in my dependencies. Even then this happens. Very perplexing issue.

$ npm --version
6.14.12

In my case the package.json looks as follows:

"dependencies": {
    "@jupyterlab/application": "^2.1.2",
    "@jupyterlab/apputils": "^2.1.1",
    "@jupyterlab/cells": "^2.1.2",
    "@jupyterlab/docmanager": "^2.1.2",
    "@jupyterlab/notebook": "^2.1.2",
    "@jupyterlab/observables": "^3.1.0",
    "@jupyterlab/services": "^5.1.0",
    "analytics": "^0.2.5"
}

and devDependencies:

"devDependencies": {
    "@babel/core": "^7.13.8",
    "babel-cli": "^6.26.0",
    "babel-plugin-transform-remove-console": "^6.9.4",
    "express": "^4.17.1",
    "http-proxy-middleware": "^1.2.0",
    "requires-port": "^1.0.0",
    "rimraf": "^3.0.2",
    "typescript": "^3.7.3"
}

Where no matter how I try to only install dev dependencies, I end up missing requires-port, which is required by http-proxy-middleware, causing it to no longer work.

Only when running npm install I can get it to install that dependency, as it seems to be a sub dependency of some who-knows-which dependency in dependencies. So this means, that instead of installing dev dependencies, I need to install all dependencies, even, when I do not need them for my development process.

[ljharb]

@ZelphirKaltstahl can you try with npm 7?

[xqin]

#2028

@ljharb this bug still exists in npm@7.11.0

[ZelphirKaltstahl]

@ZelphirKaltstahl can you try with npm 7?

@ljharb With NPM 7.10.0 it seems to work. I just updated the default NodeJS I use with NVM to default -> stable (-> v16.0.0) which means using NPM 7.10.0. Seems like it became the new stable very recently.

For reference the exact command I used is:

npm install --only=dev --ignore-scripts .

Inside the project's directory of course.

(Note: I did not check, whether it installed more than only the dev dependencies.)

[cloudratha]

@ZelphirKaltstahl can you try with npm 7?

@ljharb With NPM 7.10.0 it seems to work. I just updated the default NodeJS I use with NVM to default -> stable (-> v16.0.0) which means using NPM 7.10.0. Seems like it became the new stable very recently.

For reference the exact command I used is:

npm install --only=dev --ignore-scripts .

Inside the project's directory of course.

(Note: I did not check, whether it installed more than only the dev dependencies.)

It always worked under simple conditions. For me it wouldn't work if I had this scenario:

rimraf is installed under my devDependencies. I have another package called random that has rimraf installed as a dependency. Using --only=dev would not install rimraf in my package because of this mismatch.