Unable to shrinkwrap if the dependency tree contains request@2.66.0

[suprememoocow]

This bug seems a bit crazy, but hear me out:

We recently updated some dependencies and tried to shrinkwrap, but shrinkwrap continually fails with extraneous dependencies in the module tree.

It appears to be related to the recent release of request, so:

If I try to shrinkwrap request:

git clone git@github.com:request/request.git
npm i --production
~/code/opensource/request $ npm shrinkwrap
npm ERR! Problems were encountered
npm ERR! Please correct and try again.
npm ERR! extraneous: sshpk@1.6.2 /Users/andrewn/code/opensource/request/node_modules/sshpk

However, if I try:

git checkout d46a4c727ed7368e4625f9204f140904cc3f4478 # 2.61.1
rm -rf node_modules/
npm i --production
npm shrinkwrap # --> Success

Note, that I'm not actually trying to shrinkwrap request. The problem is that if I try shrinkwrap my module and my module depends on request, then the shrinkwrap for my module will fail with the same error.

I'm not sure if this is a problem with request or a problem with npm, most likely it's npm, but I'm reporting it here since other people are likely to experience the same problem (we've tried this on different developers environments and are getting the same issue)

Some details:

• npm@2.14.11
• node@v0.10.40

[scottgrasley]

+1

[suprememoocow]

@scottgrasley are you also experiencing this problem? I'm still digging, but if definitely appears to be an issue with npm rather than request itself.

[simov]

See this: #1909
and this TritonDataCenter/node-http-signature#51

[suprememoocow]

Thanks for the pointers @simov. I'll close this issue then as a duplicate of #1909.

[simov]

I'll actually re-open this for now. It will be easier to find it this way.

[scottgrasley]

@suprememoocow Yes, I'm seeing the same problem with sshpk when running npm shrinkwrap. I ended up including request@2.65 in my package and that mitigates the problem for now.

Thanks!

[ghost]

http-signature & sshpk already patched peerDependency issue - TritonDataCenter/node-http-signature#51

PR is on the way - https://github.com/request/request/pull/1913/files

[simov]

request@2.67.0 is published on NPM 🎉

[suprememoocow]

Thanks for the quick turnaround on this @simov @sonyschan!