Skip to content

[BUG] --omit=dev does not omit root devDependencies in linked install strategy when shared with workspace prod deps #9080

@manzoorwanijk

Description

@manzoorwanijk

Is there an existing issue for this?

  • I have searched the existing issues

This issue exists in the latest npm version

  • I am using the latest npm

Current Behavior

When using npm install --omit=dev with installStrategy: linked in a monorepo, dev dependencies declared in the root package.json are still symlinked into root's node_modules/ in two cases:

  1. External packages that are both a root devDependency and a production dependency (direct or transitive) of a workspace. The package correctly goes into the store (the workspace needs it), but root incorrectly gets a symlink to it.
  2. Workspaces declared as root devDependencies (e.g. @wordpress/build in Gutenberg) are always hoisted to root's node_modules/ regardless of --omit=dev.

Dev dependencies that are only referenced as devDependencies (not shared with any workspace prod dep) are correctly omitted by the existing fix in PR #9066.

Expected Behavior

With --omit=dev, root's devDependencies should not be symlinked into root's node_modules/, even if the same packages are needed by workspaces as production dependencies. The packages should still be in the store (since workspaces need them), but root should not link to them.

Steps To Reproduce

  1. Create a monorepo with linked install strategy:
// package.json
{
  "name": "myapp",
  "workspaces": ["packages/*"],
  "dependencies": { "which": "1.0.0" },
  "devDependencies": { "typescript": "5.0.0" }
}
// packages/mylib/package.json
{
  "name": "mylib",
  "dependencies": { "typescript": "5.0.0" }
}
  1. Add .npmrc with install-strategy=linked
  2. Run npm install --omit=dev
  3. Observe that typescript is symlinked in root node_modules/ despite being a root devDependency

This also affects workspaces declared as root devDependencies (e.g. @wordpress/build in Gutenberg). Even with --omit=dev, these workspaces get symlinked into root's node_modules/ because npm auto-creates workspace type edges (not dev edges) and #rootDeclaredDeps unconditionally includes devDependencies keys.

Environment

  • npm: v10 and v11 (latest) -- both affected
  • Node.js: v22.20.0
  • OS Name: macOS (Darwin)
  • npm config:
    install-strategy=linked

Metadata

Metadata

Assignees

No one assigned

    Labels

    Bugthing that needs fixingNeeds Triageneeds review for next steps

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions