[BUG] npm-ls result missing `dev`/`devOptional`/`optional` flags

[jkowalleck]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

test bed:

• https://github.com/CycloneDX/cyclonedx-node-npm/blob/8be4c867245bb23035625a92ae2f0ab7390981b2/tests/_data/dummy_projects/with-prepared/package.json
• https://github.com/CycloneDX/cyclonedx-node-npm/blob/8be4c867245bb23035625a92ae2f0ab7390981b2/tests/_data/dummy_projects/with-prepared/package-lock.json

when running npm ls --json --all --long, i get

{
  // ...
  "uuid": {
      "version": "8.3.2",
      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
      "overridden": false,
      "name": "uuid",
      "description": "RFC4122 (v1, v4, and v5) UUIDs",
      "commitlint": {
        "extends": [
          "@commitlint/config-conventional"
        ]
      },
      "keywords": [
        "uuid",
        "guid",
        "rfc4122"
      ],
      "license": "MIT",
      "bin": {
        "uuid": "dist/bin/uuid"
      },
      "sideEffects": false,
      "main": "./dist/index.js",
      "exports": {
        ".": {
          "node": {
            "module": "./dist/esm-node/index.js",
            "require": "./dist/index.js",
            "import": "./wrapper.mjs"
          },
          "default": "./dist/esm-browser/index.js"
        },
        "./package.json": "./package.json"
      },
      "module": "./dist/esm-node/index.js",
      "browser": {
        "./dist/md5.js": "./dist/md5-browser.js",
        "./dist/rng.js": "./dist/rng-browser.js",
        "./dist/sha1.js": "./dist/sha1-browser.js",
        "./dist/esm-node/index.js": "./dist/esm-browser/index.js"
      },
      "files": [
        "CHANGELOG.md",
        "CONTRIBUTING.md",
        "LICENSE.md",
        "README.md",
        "dist",
        "wrapper.mjs"
      ],
      "devDependencies": {
          // ...
      },
      "optionalDevDependencies": {
        "@wdio/browserstack-service": "6.4.0",
        "@wdio/cli": "6.4.0",
        "@wdio/jasmine-framework": "6.4.0",
        "@wdio/local-runner": "6.4.0",
        "@wdio/spec-reporter": "6.4.0",
        "@wdio/static-server-service": "6.4.0",
        "@wdio/sync": "6.4.0"
      },
      "scripts": {
      },
      "repository": {
        "type": "git",
        "url": "https://github.com/uuidjs/uuid.git"
      },
      "husky": {
        "hooks": {
          "commit-msg": "commitlint -E HUSKY_GIT_PARAMS",
          "pre-commit": "lint-staged"
        }
      },
      "lint-staged": {
        "*.{js,jsx,json,md}": [
          "prettier --write"
        ],
        "*.{js,jsx}": [
          "eslint --fix"
        ]
      },
      "standard-version": {
        "scripts": {
          "postchangelog": "prettier --write CHANGELOG.md"
        }
      },
      "_id": "uuid@8.3.2",
      "extraneous": false,
      "path": "/home/flow/Documents/Coding/node/cyclonedx-node-npm/tests/_data/dummy_projects/with-prepared/node_modules/uuid",
      "_dependencies": {},
      "peerDependencies": {}
    }
  // ...
}

and when running npm ls --json --all --long --package-lock-only, i get

{
  // ...
  "uuid": {
      "version": "8.3.2",
      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
      "overridden": false,
      "name": "uuid",
      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
      "devOptional": true,
      "bin": {
        "uuid": "dist/bin/uuid"
      },
      "_id": "uuid@8.3.2",
      "extraneous": false,
      "path": "/home/flow/Documents/Coding/node/cyclonedx-node-npm/tests/_data/dummy_projects/with-prepared/node_modules/uuid",
      "_dependencies": {},
      "devDependencies": {},
      "peerDependencies": {}
    }
  // ...
}

the relevant difference between the two result is: when used without --package-lock-only switch, then there is

• additional info fetched from package.lock files
• no integrity
• no dev/devOptional/optional indicator

Expected Behavior

when running npm ls --json --all --long without --package-lock-only switch, i'd expect to see the dev/devOptional/optional indicator for respective packages in the result.

Steps To Reproduce

1. In this environment...
   • package.json: https://github.com/CycloneDX/cyclonedx-node-npm/blob/8be4c867245bb23035625a92ae2f0ab7390981b2/tests/_data/dummy_projects/with-prepared/package.json
   • package-lock.json: https://github.com/CycloneDX/cyclonedx-node-npm/blob/8be4c867245bb23035625a92ae2f0ab7390981b2/tests/_data/dummy_projects/with-prepared/package-lock.json
2. With this config...
   • none specific
3. Run 'npm ls --json --all --long'
4. See missing "devOptional": true, for package "uuid" in result

Environment

• npm: 11.5.2
• Node.js: v22.17.0
• OS Name: some debian
• System Model Name:
• npm config:

; "user" config from /home/.../.npmrc

; node bin location = /usr/bin/node
; node version = v22.17.0
; npm local prefix = /home/...
; npm version = 10.9.2
; cwd = /home/...
; HOME = /home/...
; Run `npm config ls -l` to show all defaults.

[milaninfy]

@jkowalleck dev, devOptional, optional, integrity etc comes from package-lock.json directly that's why they are present when you use --package-lock-only flag.. when without using that flag npm ls looks directly in node_modules and package.json to produce output so they might not have information about other things like integrity and all.

[jkowalleck]

the --package-lock-only suggests, that the lock file only is analyzed -not the content of the node_modules folder.
the absence of this flag suggests, that the lock file is analyzed, as well as the content of node_modules folder.

[milaninfy]

@jkowalleck dev, devOptional, optional, integrity etc comes from package-lock.json directly that's why they are present when you use --package-lock-only flag.. when without using that flag npm ls looks directly in node_modules and package.json to produce output so they might not have information about other things like integrity and all.

as explained here, this is currently working as expected and is by design as explained