NPM module pushed with hard-coded @types/codemirror@0.0.96

[lf-novelt]

Hello,

After having installed npm install @ctrl/ngx-codemirror, I noticed that in the node_modules folder of this module, there is a child node_modules folder containing the @types/codemirror module, see screenshot below.

I guess it's a mistake as the dependency @types/codemirror (that should be in devDependencies btw) should be fetched by NPM, and not included in the same package.

This also creates a critical issue as the included version 0.0.96 contains some types do not match with the ones in the current version, see below screenshot of package.json of types/codemirror module.

My current workaround is to manually remove that node_modules folder after each npm install.

I'd be thankful to republish on NPM without including the node_modules folder in the built package.

[scttcper]

@types/codemirror is a dependency because the types for ngx-codemirror re-expose the types in @types/codemirror. Without it, typescript would not be able to do type checks.

The version published is not pinned so it should get whatever the latest version is using npm update or reinstalling.

❯ npm info @ctrl/ngx-codemirror dependencies
{ '@types/codemirror': '^0.0.96', tslib: '^2.0.0' }

[lf-novelt]

Thanks for the quick reply. I agree the version is not pinned, so it should thoerically take the latest minor which is 0.0.98 but after installing, I ended up with both versions 0.0.98 locally and 0.0.96 used by this module. So I think there is something not configured properly in the published NPM package.

I am pretty sure there should not a node_modules\@types folder into node_modules\@ctrl\ngx-codemirror\, both should be a the same level, don't you agree?

[scttcper]

yeah i would try removing your node_modules and package-lock, it should resolve to the same version

[lf-novelt]

So I did a fresh install on another project that did not have codemirror installed and it did not create a scoped node_modules subfolder but it did install the 0.0.96 version instead of the 0.0.98 in the root node_modules folder.

Is it because it's listed in the requires rather than the dependencies in the package-lock.json?

[lf-novelt]

for those looking to automate the workaround, here is my npm postinstall script to delete the inner node_modules folder,

  "scripts": {
    "ng": "ng",
    "postinstall": "rd /s /q node_modules\\@ctrl\\ngx-codemirror\\node_modules >nul 2>&1|echo.>nul && ngcc --properties es2015 browser module main --first-only --create-ivy-entry-points"