[BUG] install --only=development doesn't install needed dependencies if listed in production dependencies #1669
Description
Current Behavior:
If I have a list of dependencies and devDependencies such that devDependencies[x] depends on dependencies[y] and I run npm install --only=development, only devDependencies[x] is installed.
In a related twist, swapping the direction of dependencies (such that dependencies[x] depends on devDependencies[y]) and running npm install --only=development results in no packages being installed at all.
Expected Behavior:
When running npm install --only=development I would expect all required direct devDependencies and any transitive dependencies of any stripe (dependencies, devDependencies or unlisted) to be installed.
Steps To Reproduce:
A concrete example involves lodash and json-replace (the former with no dependencies, and the latter with only one dependency, on lodash):
$ cat package.json
{
"name": "npm-dev-only",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"author": "",
"license": "ISC",
"dependencies": {
"lodash": "*"
},
"devDependencies": {
"json-replace": "*"
}
}
$ rm -rf node_modules
$ npm install --only=development
npm WARN npm-dev-only@1.0.0 No description
npm WARN npm-dev-only@1.0.0 No repository field.
added 1 package from 1 contributor and audited 2 packages in 1.195s
found 8 vulnerabilities (4 low, 4 high)
run `npm audit fix` to fix them, or `npm audit` for details
$ find node_modules -name package.json -type f
node_modules/json-replace/package.json
Swapping it around:
$ cat package.json
{
"name": "npm-dev-only",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"author": "",
"license": "ISC",
"dependencies": {
"json-replace": "*"
},
"devDependencies": {
"lodash": "*"
}
}
$ rm -rf node_modules
$ npm install --only=development
npm WARN npm-dev-only@1.0.0 No description
npm WARN npm-dev-only@1.0.0 No repository field.
audited 3 packages in 0.464s
found 8 vulnerabilities (4 low, 4 high)
run `npm audit fix` to fix them, or `npm audit` for details
$ find node_modules -name package.json -type f
find: node_modules: No such file or directory
Environment:
- OS: macOS 10.13.6
- Node: v14.5.0
- NPM: 6.14.7