npm install --save with a git dependency saves a relative path to tmp/

[aearly]

aearly@alpha:~/projects/some-project
$ npm --version
2.2.0

aearly@alpha:~/projects/some-project
$ npm i git://github.com/aearly/somemodule --save
somemodule@0.1.0 node_modules/somemodule

aearly@alpha:~/projects/some-project
$ grep somemodule package.json 
    "somemodule": "file:../../../../tmp/npm-10362-85236a5e/1421102722335-0.624850605847314/b1567b5b2223729d0a4fe3d82513241e6e1035df",

Prior to NPM 2.0, this would have saved as:

    "somemodule": "git://github.com/aearly/somemodule",

It works as expected if I use the aearly/somemodule shorthand.

[smikes]

Thanks for the bug report!

/cc @othiym23 bug report

[othiym23]

Confirmed. Thanks for the report! This needs both a patch and a regression test, because I'm sure my recent meddling with git caching to fix things is responsible for this, but none of the relevant tests caught it.

[KidkArolis]

Is there already an issue filed about tmp folders being put into the shrinkwrap (has been happening since npm >2.1.4):

    "cookieman": {
       "version": "0.0.0",
       "from": "../../../../../var/folders/hf/nd46_7jd41zd1g1bgymsl1rw0000gn/T/npm-31235-4b3b79e1/git-cache-2c0066f6ed57/9f1b66bdc0460c86e5d72cfe66b210422826f877",
       "resolved": "git+ssh://git@github.com:cookieman/cookieman.git#9f1b66bdc0460c86e5d72cfe66b210422826f877"
     }

[KidkArolis]

Ah, I can see this is related to how git deps are installed.. (the installed package.json contains incorrect "_from" which must break the shrinkwrap)

[gaearon]

I would be so happy to see this fixed!

[aredridel]

Likewise! this bit me and I forgot to report it!

[othiym23]

See #7296 for a fix for this, which may or may not land this week.

[smikes]

Did this get fixed as part of npm@2.7.0?

[othiym23]

@smikes I don't know / don't think so. They turned out to be fairly different issues.

[KidkArolis]

:(

This issue (I think it's this issue) breaks all npm+git+shrinkwrap usage. It's preventing my team and me from upgrading to anything above npm 2.1.4.

Not complaining - just letting you know ;)

I'll try to take a closer look at whether this is resolved in 2.7.0 and see if I can fix it..

[KidkArolis]

I can confirm the issue still happens in 2.7.0.

Steps to reproduce

$ mkdir foo
$ cd foo
$ npm init
$ npm install --save git+ssh://git@github.com:QubitProducts/pkguid

package.json contains:

{
  ...
  "dependencies": {
    "pkguid": "file:../../../../../../var/folders/hf/nd46_7jd41zd1g1bgymsl1rw0000gn/T/npm-18964-1b8d06aa/git-cache-10aa7514779c/894f50939c7626c6d3d61ff33faa71155290bcf4"
  }
}

This also affects node_modules/pkguid/package.json#_from as well as npm shrinkwrap.

[othiym23]

This also needs to get fixed soon to unblock shrinkwrap users, so I will look at getting this into this week's release.

[othiym23]

There is a fix in #7539; it got kind of messy because I realized that lib/cache/add-remote-git.js had become a disaster area and I no longer really understood how the whole thing worked. This will be included in this week's release. Feel free to review the PR if you like.

[othiym23]

This is finally fixed in 6823807. With any luck, I a. didn't introduce any new regressions and b. have made it less likely that things will go wrong with caching git remotes in the future. Thanks to everyone for their patience.

[KidkArolis]

❤️

[aearly]

🎠 🌈 💫

[lxe]

[imsaar]

I just ran into this issue and I upgraded to npm 2.11.0 (from 2.7.0) and it is now resolved.

Just do npm install npm -g
And shrinkwrap again