Skip to content

[BUG] Arbitrary package hoisting on NPM workspaces can lead to issues #5840

@Antonio-Laguna

Description

@Antonio-Laguna

Is there an existing issue for this?

  • I have searched the existing issues

This issue exists in the latest npm version

  • I am using the latest npm

Current Behavior

NPM workspaces install dependencies at different levels of the app. When things are required you can get errors because things aren't at the same level.

When root dependency tries to require nested dependency there're issues. While you can often hoist dependencies up this is not always desirable.

It does not work if nested calls to root that tries to find a nested dependency, require.resolve.paths show that cwd isn't included on those paths.

Expected Behavior

require works as long in, either way, no matter where npm decides to install the dependency, or we should be able to set where packages are installed.

See nodejs/node#43429

Steps To Reproduce

  1. Need to have workspaces
  2. Have dependencies that live in different places (root vs package)
  3. A dependency that lives on root that, called from package require a nested package

This is reproducible in this small repository: https://github.com/Antonio-Laguna/node-workspaces-bug

Environment

  • npm: 8.11.0
  • Node.js: v16.15.1
  • OS Name: macOS 13.0
  • System Model Name: Macbook Pro
  • npm config:
; "user" config from /Users/alaguna/.npmrc

//registry.npmjs.org/:_authToken = (protected)
node_gyp = "usr/local/bin/node-gyp"
tag-version-prefix = ""

; node bin location = /Users/alaguna/.nvm/versions/node/v16.15.1/bin/node
; node version = v16.15.1
; npm local prefix = /Users/alaguna
; npm version = 8.11.0
; cwd = /Users/alaguna
; HOME = /Users/alaguna
; Run `npm config ls -l` to show all defaults.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Bugthing that needs fixingNeeds Triageneeds review for next stepsRelease 8.xwork is associated with a specific npm 8 release

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions