npm 5 uninstalls dependencies when switching between branches/configs

[Standard8]

I'm opening this issue because:

• npm is crashing.
• npm is producing an incorrect install.
• npm is doing something I don't understand.
• Other (see below for feature requests):

What's going wrong?

Using npm 5, I'm trying to commit package.json and npm-shrinkwrap.json (or package-lock.json) changes on a branch and then simulate pushing those out to users.

When switching to the new branch and running install, the relevant package gets updated, but dependencies get uninstall.

How can the CLI team reproduce the problem?

Run this script:

mkdir test-bug
cd test-bug
git init .
echo 'node_modules' >> .gitignore
npm init -y
npm install eslint
npm install eslint-plugin-react@6.10.3
git add package.json package-lock.json
git commit -m "Initial version"
git checkout -b new-version
rm -r node_modules
npm install
npm install eslint-plugin-react@7.1.0
git commit -m "Upgrade plugin-react" -a
git checkout master
rm -r node_modules
npm install
git checkout new-version
npm install
git diff

At the end of it, you'll see that there are three modules no longer in the package-lock.json, and trying to use the react plugin would fail.

Output Diff

diff --git a/package-lock.json b/package-lock.json
index bf02c7a..1b05023 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -230,11 +230,6 @@
       "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
       "integrity": "sha1-FQStJSMVjKpA20onh8sBQRmU6k8="
     },
-    "function-bind": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.0.tgz",
-      "integrity": "sha1-FhdnFMgBeY5Ojyz391KUZ7tKV3E="
-    },
     "generate-function": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/generate-function/-/generate-function-2.0.0.tgz",
@@ -265,11 +260,6 @@
       "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.1.11.tgz",
       "integrity": "sha1-Dovf5NHduIVNZOBOp8AOKgJuVlg="
     },
-    "has": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/has/-/has-1.0.1.tgz",
-      "integrity": "sha1-hGFzP1OLCDfJNh45qauelwTcLyg="
-    },
     "has-ansi": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/has-ansi/-/has-ansi-2.0.0.tgz",
@@ -380,11 +370,6 @@
       "resolved": "https://registry.npmjs.org/jsonpointer/-/jsonpointer-4.0.1.tgz",
       "integrity": "sha1-T9kss04OnbPInIYi7PUfm5eMbLk="
     },
-    "jsx-ast-utils": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/jsx-ast-utils/-/jsx-ast-utils-1.4.1.tgz",
-      "integrity": "sha1-OGchPo3Xm/Ho8jAMDPwe+xgsDfE="
-    },
     "levn": {
       "version": "0.3.0",
       "resolved": "https://registry.npmjs.org/levn/-/levn-0.3.0.tgz",

From looking at the silly debug log output, it appears that the modules were listed in the current tree, but were removed from the ideal tree for some reason.

supporting information:

• npm -v prints: 5.0.3
• node -v prints: v8.1.0
• npm config get registry prints: https://registry.npmjs.org/
• Windows, OS X/macOS, or Linux?: macOS 10.12.5
• Network issues:
  • Geographic location where npm was run:
  • I use a proxy to connect to the npm registry.
  • I use a proxy to connect to the web.
  • I use a proxy when downloading Git repos.
  • I access the npm registry via a VPN
  • I don't use a proxy, but have limited or unreliable internet access.
• Container:
  • I develop using Vagrant on Windows.
  • I develop using Vagrant on OS X or Linux.
  • I develop / deploy using Docker.
  • I deploy to a PaaS (Triton, Heroku).

[Salakar]

Happening for a few of our users who are using v5 also in issue mentioned above.

[Standard8]

I've just tested this in 5.1.0 and there seems to be no problems now.

Thank you to those that helped fix this.