[BUG] The version of untagged git+file dependency is replaced unexpectedly

[proletarius101]

Current Behavior:

The version of untagged git+file dependency is replaced by a "newer" version (as in the version field of package.json), which doesn't exist as a tag. So npm will try to search it via the internet, which is a no-go for the --offline mode.

Expected Behavior:

Keep the version as-is.

Steps To Reproduce:

Say, I have a git+file dependency:

    "decrypt": "git+file:/****/decrypt-5d487038d3568d180e7cf561d774e1b685985d62#5d487038d3568d180e7cf561d774e1b685985d62",

where 5d487038d3568d180e7cf561d774e1b685985d62 is the commit hash of the desired version.

If the repo at /****/decrypt-5d487038d3568d180e7cf561d774e1b685985d62 is not tagged at all, but having a version field in the package.json, it will

17 info lifecycle [email protected]~prepack: [email protected]
18 info lifecycle [email protected]~postpack: [email protected]
...

21 silly removeObsoleteDep removing decrypt@github:standardnotes/decrypt#5d487038d3568d180e7cf561d774e1b685985d62 from the tree as its been replaced by a newer version or is no longer required
22 silly removeObsoleteDep removing @standardnotes/[email protected] from the tree as its been replaced by a newer version or is no longer required
23 silly removeObsoleteDep removing @standardnotes/[email protected] from the tree as its been replaced by a newer version or is no longer required
24 silly removeObsoleteDep removing [email protected] from the tree as its been replaced by a newer version or is no longer required
25 silly removeObsoleteDep removing [email protected] from the tree as its been replaced by a newer version or is no longer required
26 silly removeObsoleteDep removing @standardnotes/[email protected] from the tree as its been replaced by a newer version or is no longer required

Environment:

❯ npm -v
6.14.10

[proletarius101]

Related: flatpak/flatpak-builder-tools#182

[darcyclarke]

npm v6 is no longer in active development; We will continue to push security releases to v6 at our team's discretion as-per our Support Policy.

If your bug is preproducible on v7, please re-file this issue using our new issue template.

If your issue was a feature request, please consider opening a new RRFC or RFC. If your issue was a question or other idea that was not CLI-specific, consider opening a discussion on our feedback repo