[BUG] npm install fails with EACCES on a package.json with no EOF

[mnmkng]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

NPM 7 fails with an EACCES error when npm install is run with a package.json that:

1. does not have a new line at the end, AND
2. the user does not have the permission to write to the package.json.

It most likely happens because of npm/npm#18545

NPM 6 does not fail like this.

Expected Behavior

I would expect npm install to work even with only read permissions to package.json.

The EOF new line has no meaning there, everything should work fine without it (on most systems), NPM does not really need to write to the package.json so read rights should be enough to execute npm install.

NPM 6 most likely does not fail, because it runs with higher privileges and writes the EOF even if the permissions on the package.json prevent it, but that's a different issue.

Steps To Reproduce

1. npm init -y
2. remove EOF new line from package.json
3. chmod 444 package.json
4. npm i
5. NPM 7 fails with EACCES, NPM 6 keeps going

Environment

• OS: MacOs, various Linuxes
• Node: 15, 16
• npm: 7

[mnmkng]

Also note that the error message is quite confusing, because the open implies a read problem and the fact that npm install would write something to the package.json is an obscurity that we only found out by blind luck.

Error: EACCES: permission denied, open '/.../package.json'

And yeah, we mostly have end of file new lines everywhere, but in this particular case, we were generating the package.json by JSON.stringify(content) and therefore, no new line was there.

[darcyclarke]

Note: we don't want to change the permissions of package.json from what you - as the user - have explicitely defined, so the EACCESS error will persist if you've chmod'd the dir/file to prevent writes (this was incorrectly being allowed in v6) & we will always write files w/ a carriage return; What we can/will do here though is ensure we don't write the file if we don't see that line break (/cc @ruyadorno who should be in this code at the moment).

[mnmkng]

Yeah, agree and thank you. It totally makes sense to have EOF in files. We've fixed our permissions in the meantime, but I think it still makes sense for npm install not to fail for people who have only read permissions to the package.json.