-
Notifications
You must be signed in to change notification settings - Fork 4.2k
Closed
Description
Is there an existing issue for this?
- I have searched the existing issues
- I am using the latest npm
Related to #9063
Current Behavior
npm install --omit=dev with install-strategy=linked installs all dependencies including devDependencies. The flag is silently ignored — dev packages appear in node_modules/.store/ and are symlinked as normal.
Expected Behavior
Dev dependencies should not be installed, same as with the default hoisted strategy.
Steps To Reproduce
mkdir -p /tmp/repro/packages/my-lib && cd /tmp/repro
cat > package.json << 'EOF'
{
"name": "my-monorepo",
"private": true,
"workspaces": ["packages/*"],
"dependencies": {
"abbrev": "^2.0.0"
},
"devDependencies": {
"semver": "^7.6.0"
}
}
EOF
cat > packages/my-lib/package.json << 'EOF'
{
"name": "my-lib",
"version": "1.0.0",
"dependencies": {
"abbrev": "^2.0.0"
},
"devDependencies": {
"lru-cache": "^10.0.0"
}
}
EOF
echo "install-strategy=linked" > .npmrc
npm install --omit=dev
ls node_modules/.store/
# Expected: only abbrev
# Actual: abbrev, lru-cache, semver (dev deps included)For comparison, removing install-strategy=linked from .npmrc and running the same command correctly omits semver and lru-cache.
Root Cause
The isolated reifier builds its proxy tree from idealGraph which contains all resolved dependencies. It never checks the omit option — dev dependencies are unconditionally included. The proxy nodes also lack dev/optional/peer edge metadata, so Diff.calculate() can't filter them either.
Environment
- npm: 11.x (latest) and 10.9.5 — both affected
- Node.js: 22.20.0
- OS Name: macOS (Darwin 25.3.0)
- npm config:
install-strategy=linked
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels