document how to perform npm operations with a symlinked node_modules

[dnr]

Is your feature request related to a problem? Please describe.

I'm using a symlinked node_modules by calling npmlock2nix in my shell.nix, so that my interactive processes use the exact same files as my build. At some point I'd like to run npm update on some of my dependencies. When I do this, npm rightfully complains with npm WARN checkPermissions Missing write access to /my/project/node_modules/...

The npm install man page describes the --package-lock-only flag, which sounds like it should do what I want, but it doesn't actually work. In any case, npm update doesn't have that flag.

As a workaround, I suppose that a workaround might be: copying node_modules to the current directory, running npm, and then deleting it and letting npmlock2nix rebuild a node_modules in the nix store and create a symlink to it. That seems pretty annoying, though.

Describe the solution you'd like

Document the intended way to use npm commands that modify package.json or package-lock.json when using a symlinked node_modules.

If this requires some work on the npm side, is there a feature request filed there? Does yarn or another alternative npm implementation have a "resolve only, don't install" mode?

[andir]

I don't think that updating dependencies with symlinked node_modules is currently possible for all the reasons you've mentioned. There in no feature request on the NPM side just yet as I haven't really spent much time on this project (it does work for my initial requirements, switched employers, ...). If you can open one that would be great.

[dnr]

I dug around in the npm issues to see if this had been filed already, and was just about to file it when I found npm/cli#3408, which makes this work (or documents a previous change that made it work). With that, I was able to install and update using --package-lock-only with no errors about not being able to write to node_modules.

So probably all that has to be done is update the docs to say use npm version >= 7.18.0 and add --package-lock-only to npm install + update commands.