Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

NPM: Never install nested optional dependencies for npm package

Tags:

node.js

npm

I'm authoring a package A which I want to publish to NPM.

A has a dependency on package B, which in turn has a dependency on package C. C then has two optional native dependencies D and E. I know for definite I have no use for the optional dependencies, D and E, and NEVER want to try and install them when someone installs my package.

I know you can use the command npm install A --no-optional -g to install the package without optional dependencies, but this would be knowledge/overhead that I'd rather consumers of the package not need.

Is there any npm config or workaround where consumers of package A can just npm install A or npm install -g A and optional dependencies will never be installed?

Thanks

like image 893
patocallaghan Avatar asked Nov 05 '15 10:11

patocallaghan


People also ask

Does npm install install optional dependencies?

By default, npm install will install all modules listed as dependencies in package. json . With the --production flag (or when the NODE_ENV environment variable is set to production ), npm will not install modules listed in devDependencies .

How do I override nested npm dependency versions?

If the nested dependency (with vulnerability) is already fixed but the main dependency isn't, you can use overrides field of package. json as explained in StackOverflow answer. You'll need a recently new version of npm cli v8. 3.0 (2021-12-09) which comes with Node.

What is npm install -- no optional?

See npm-folders(5) . The --link argument will cause npm to link global installs into the local space in some cases. The --no-bin-links argument will prevent npm from creating symlinks for any binaries the package might contain. The --no-optional argument will prevent optional dependencies from being installed.


1 Answers

npm install A --no-optional

Test to see if everything works.

npm list

Make sure you have no errors.

npm shrinkwrap

That will lock down the dependencies for the packages.

That way npm install will look into npm-shrinkwrap.json before trying to install dependencies.

You can read more about it here https://docs.npmjs.com/cli/shrinkwrap

like image 189
ordepim Avatar answered Sep 19 '22 12:09

ordepim