Regression? Change? Can no longer install a single package without all the other dependencies in package.json

[dandv]

Current Behavior:

Running npm install <package> --no-package-lock --production --no-save will still install all other dependencies listed in package.json.

Expected Behavior:

This did not use to be the case with npm 6. NPM 6 would install only the requested package.

Steps To Reproduce:

1. npm install cheerio # this will install 14 packages in node_modules
2. rm -rf node_modules package-lock.json
3. npm install local-iso-dt --no-package-lock --production --no-save

This will output added 15 packages, and node_modules does contain all the cheerio dependencies, instead of just the zero-dependency local-iso-dt module.

Environment:

• OS: Ubuntu 20.04
• Node: 14.16.0
• npm: 7.8.0

Related

• [FEATURE] Add ability to install only the packages in package.json without any of their dependencies #1216

[ljharb]

Just curious, why do you need --production on that command? npm install <package> never installs its dev deps. Additionally, with --no-save, why do you need --no-package-lock?

If you just do npm install local-iso-dt --no-save, what happens?

[dandv]

@ljharb none if those options are needed; I just used them as a sanity check.

Running just npm install local-iso-dt --no-save produces the same result - cheerio and its deps are installed.

[nlf]

npm 7 always does its best to work on full package trees rather than individual packages. that is, we do our best to ensure that what's on disk in your node_modules directory satisfies your complete requested dependency tree as specified in your package.json.

when adding a package, we add it to the dependency tree in your package.json, and then make your node_modules match that final, complete, tree. we currently do not have a way to install a single package in a project that contains a package.json.

if you have a use case for it, you may consider opening an rfc or a discussion at https://github.com/npm/rfcs

[dandv]

Thanks @nlf, created npm/rfcs#364.

[kgryte]

I agree with @dandv that the behavior observed in npm v7 is unexpected, especially as v7 provides no way to override using a package.json as the sole source of truth without explicitly changing and/or removing the package.json file.

[tomchambers2]

I have just run into this with an authenticated package. We have a package @private/component-library and we are using a script that uses @aws-sdk/client-codeartifact to authenticate the private repo.

Because of trying to install everything in package.json it fails with a 401 when trying to install from the private repo when all the user wants to install initially is the aws package.

We could install it globally but then we lose versioning etc.