Development dependencies can cause production dependencies to install differently

[artlogic]

What is the current behavior?

When production installing a dependency which has a child dependency that's also a devDependency, the child dependency isn't installed at the top level. If the devDependency is removed, the child dependency is installed as expected. I think this is a bug because devDependencies shouldn't affect production in any way.

If the current behavior is a bug, please provide the steps to reproduce.

Start with this package.json:

{
  "name": "test",
  "version": "1.0.0",
  "description": "test",
  "main": "index.js",
  "license": "MIT",
  "dependencies": {
    "sequelize-cli": "^2.7.0"
  }
}

Then, perform a yarn install --production. Notice that umzug (a dependency of sequelize-cli) exists under node_modules.

Now remove the node_modules directory and modify your package.json like so:

{
  "name": "test",
  "version": "1.0.0",
  "description": "test",
  "main": "index.js",
  "license": "MIT",
  "dependencies": {
    "sequelize-cli": "^2.7.0"
  }
  devDependencies": {
    "umzug": "^2.0.1"
  }
}

Once again perform a yarn install --production. Notice that umzug is no longer listed under node_modules. Rather it's at node_modules/sequelize-cli/node_modules/umzug.

What is the expected behavior?

I would expect devDependencies to have no affect on the production install process. Modifying devDependencies can actually change what packages are visible in production. This seems like incorrect behavior to me.

Please mention your node.js, yarn and operating system version.

Using yarn 0.24.5, node 6.10.3, and Mac OS 10.11.6.

[bestander]

That is expected behavior.
Yarn would build the same tree (with some branches removed) for the same package.json/yarn.lock no matter if it is installed with --production flag or not.
And that is a good thing, you end up with the same versions of dependencies trees when you are developing and deploying.

[artlogic]

Thanks for explaining. After reading this and taking another look, I now understand this behavior. Much appreciated.