search

npm / cli

the package manager for JavaScript
https://docs.npmjs.com/cli/
Other
8.49k stars 3.17k forks source link

[BUG] `npm ls --all` does not list dependency tree without node_modules #3068

Open davidacmoreira-cx opened 3 years ago

davidacmoreira-cx commented 3 years ago

Current Behavior:

The command npm ls --all does not list the dependency tree, without _nodemodules folder. This command is failing to list the dependency tree with only the package-lock.json file, using npm v7.

Expected Behavior:

Using npm v6, the npm ls command is working as expected, by listing the dependency tree, with only the package.json and package-lock.json files present, and without _nodemodules folder.

Steps To Reproduce:

  1. In a project folder with package.json and with package-lock.json files, and without _nodemodules folder
  2. Run npm ls --all --json

or

  1. In a project folder with package.json
  2. Run npm install
  3. Delete de _nodemodules folder
  4. Run npm ls --all --json

Environment:

or

nlf commented 3 years ago

confirmed, easy to reproduce this one. thanks for letting us know!

isaacs commented 3 years ago

Umm.... I'm pretty sure npm@6 used the actual tree as well?

Screen Shot 2021-06-11 at 14 55 50

The output is almost identical between v6 and v7. There is a problem that we print two JSON blobs when there's errors in v7, though, that's a bug.

G-Rath commented 3 years ago

Pulling my comment over from my PR, since this is the better place to discuss:

@isaacs I've got need to have npm list behaviour on the virtual tree for audit-app to backfill information on dependency paths & versions because the new auditing output doesn't have all the information we need for that - using the virtual tree means you don't have to actually be able to successfully install saving a lot of time and pain when using tooling to do mass project auditing.

Additionally, there is the sort-of bug/inconsistency with the output of npm audit vs npm list that I mentioned in my PR (I tried to make a simple reproduction, but it proved too hard to pin down to just a few dependencies since npm would keep trying to pull in patched versions of ini) that this would help explain.

Would implementing a new flag (i.e --virtual) be on the table? I'd expect from what I was when exploring this issue originally, it shouldn't be too hard to implement (just a matter of having the flag and then changing the line from my PR to be if: loadVirtual; else: loadActual.