You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[BUG] Dependencies scripts don't run when using v1 shrinkwrap #5525
Which uses shrinkwrap version 1 (produced by npm 6)
And has a dependency (B)
Which is using node-gyp and a custom install script
B's custom install script does not run, instead it is replaced with node-gyp rebuild.
Example:
@freekii/layerone-keytar@1.0.10 has been built and uploaded using npm 6
It has npm-shrinkwrap.json with "lockfileVersion": 1
It has keytar as a dependency
keytar has prebuild-install || npm run build
When installing @freekii/layerone-keytar@1.0.10, keytar's install script will not run, falling back to node-gyp rebuild. If the machine has no Python and required system libraries, that will fail whereas the prebuild-install would have succeeded.
Expected Behavior
Dependencies' install scripts should run as specified in their package.json.
(Using example above) Installing @freekii/layerone-keytar@1.0.10 runs keytar's prebuild-install.
Steps To Reproduce
Create an empty npm package with a single dependency keytar (or use existing @freekii/layerone-keytar@1.0.10 and skip to sten 4).
Using npm 6, run npm shrinkwrap.
Publish the package to npm with the generated shrinkwrap.
On a machine without Python or C build tools (e.g. node:16 Docker container), install the above package from npm.
System Model Name: Docker container, via Macbook Pro
npm config:
; node bin location = /usr/local/bin/node; node version = v16.17.0; npm local prefix = /; npm version = 8.19.2; cwd = /; HOME = /root; Run `npm config ls -l` to show all defaults.
Please note this is not a bug in npm 6. It was only used to produce the example package, but I expect npm 8 to be able to install older packages from the registry regardless.
Activity
koterpillar commentedon Sep 16, 2022
Please note this is not a bug in npm 6. It was only used to produce the example package, but I expect npm 8 to be able to install older packages from the registry regardless.
koterpillar commentedon Sep 16, 2022
I believe the
meta.loadedFromDiskcheck is causing the bug here:cli/workspaces/arborist/lib/arborist/rebuild.js
Line 257 in e5761b9
owlstronaut commentedon Apr 21, 2026
#9262