[BUG] NPM UPDATE removes dependencies

[artus]

Current Behavior:

npm update --no-save --dev removes dependencies from the node_modules folder.

Also, the documentation states that As with all commands that install packages, the --dev flag will cause devDependencies to be processed as well. but I can't find the --dev flag in any other part of the documentation. Shouldn't it be --save-dev instead?

Expected Behavior:

npm update --no-save --dev should update all dependencies (including dev dependencies) and NOT remove dependencies from the node_modules folder.

Steps To Reproduce:

I have a package.json with the some dev dependency:

"devDependencies": {
  "some-dependency": "latest",
...
}

When I run npm update --no-save --dev my dev depdency sometimes gets updated, but sometimes it just completely dissapears from the node_modules folder.

Every subsequent run results in the package being there or not being there:

1. npm update --no-save --dev => package is there
2. npm update --no-save --dev => package is no longer there
3. npm update --no-save --dev => package is there again
4. npm update --no-save --dev => package is again no longer there
5. npm update --no-save --dev => package is there again
6. npm update --no-save --dev => package is again no longer there
7. ...

Environment:

• OS: Windows 10
• Node: v10.16.0
• npm: 6.9.0

[ljharb]

By default, npm update covers all deps including dev deps (but not transitive dev deps, which is what the dev flag is for). Can you just omit the flag?

[artus]

Thanks for the quick reply @ljharb

I removed the --dev parameter but the behaviour still persists. I tried to replicate this with a minimal setup but I am not able to. As I am experiencing this issue on a corporate codebase I'm not able to share with you my setup :/

[ljharb]

Every npm installation command prunes anything from node_modules that isn’t in package.json. What are the things being removed?

[artus]

It's always the same package, which is installed as a dev dependency. I now remember that I linked the dependency using npm link some time ago. I didn't see any symlinks in the node_modules folder anymore, but I still ran npm unlink <path-to-dev-dependency> anyway, and now the issue seems to be resolved.

Could npm link have been the cause of this?

[ljharb]

Yes; pruning would have removed the link, and if it was in package.json, would have installed whatever was specified there.

[artus]

The dev dependency was always included in the package.json, I linked it while doing a code change. I forgot about the link, but the npm update --no-save should've removed the link anyway. Now that I manually ran npm unlink the issue does not appear anymore. I am at a complete loss, it doesn't make sense.

But all the better if it doesn't happen anymore!

Can I find some more information about the npm update command also installing dev dependencies, even without the --dev flag?

[darcyclarke]

npm v6 is no longer in active development; We will continue to push security releases to v6 at our team's discretion as-per our Support Policy.

If your bug is preproducible on v7, please re-file this issue using our new issue template.

If your issue was a feature request, please consider opening a new RRFC or RFC. If your issue was a question or other idea that was not CLI-specific, consider opening a discussion on our feedback repo

Closing: This is an automated message.