npm install is never run when dependencies are added by others

[Artur-]

When another project member adds a dependency, my project is broken until I remove node_modules.

To reproduce:

vaadin init hello
cd hello
mvn install -Pproduction # Runs npm install
git init && git add -A &&  git commit -a -m "Initial" # To know what is happening

# Now we simulate the other user who installs a-avataaar
npm i a-avataaar --save
mvn install -Pproduction # Runs npm install because hash does not match
ls node_modules/a-avataaar/ # Yup, it is there
git commit -m "Add dependency" -a # Make the commit

# Now go back and pretend to be the original user
git revert head
rm -rf node_modules/ && mvn install -Pproduction # Go back to the previous state, runs npm install
ls node_modules/a-avataaar/ # Nope, not there. Should not be either
git reset head^ --hard # Apply the patch from the other user
mvn install -Pproduction # SHOULD run npm install but does not
ls node_modules/a-avataaar/ # Nope, not there. SHOULD BE THERE

[web-padawan]

Originally reproduced in Starter Wizard, when added new lines to "devDependencies" manually.

[Artur-]

Would a potential solution to this be to store the hash inside node_modules, e.g. node_modules/.vaadin with {hash: 'abc123'} so that it would represent what was last installed. If the hash in package.json does not match, then npm install must be run.

This would also solve the "npm install was interrupted" problem as the hash should only be written once npm install has finished successfully.

[caalador]

That sounds like a good suggestion.

[Artur-]

Presumably if both the package.json and node_modules hash was updated by a postinstall script in the project's package.json then you would also avoid running npm install again when starting the server with mvn after installing a package using npm.

Right now it goes like this in 14.2+

vaadin init hello
cd hello
mvn install -Pproduction # Runs npm install like it should
npm i --save a-avataaar # Installs but does not update anything
mvn install -Pproduction # Runs npm install because hash was not updated