36 ms·

Which part of npm acts unexpectedly?

by h1d 8y ago

coding123 8y ago
We switched around June last year to yarn because git URL dependencies on branches was broken in npm. It would choose incorrect commit ids inexplicably. Beyond that dependency upgrade time is faster.
dhritzkiv 8y ago
Not that this is a showstopper, but I have issues with the package-lock.json file where the `resolved` field (the package's registry URL) constantly flip flops between http and https protocols, depending on which machine I'm on (home, work, or docker container), whenever I run `npm install`. Sounds not so bad, but it becomes a mess in git, and causes any docker build caches to become invalidated.
- scrollaway 8y ago
  That sounds pretty bad and I'm not so sure it's a npm bug. Do you have a diff of the change in question? Is it on the npm registry or a custom one?
  - dhritzkiv 8y ago
    It's on the npm registry, affecting the npm client: https://npm.community/t/some-packages-have-dist-tarball-as-http-and-not-https/285/51 https://npm.community/t/some-packages-have-dist-tarball-as-h...
- jwalton 8y ago
  A very similar bug that we run into sometimes: https://npm.community/t/npm-install-or-npm-update-turns-a-bunch-of-resolved-in-package-lock-json-from-real-values-to-false/3308 https://npm.community/t/npm-install-or-npm-update-turns-a-bu...
- whatever_dude 8y ago
  Oh man, I get that all the time, hate it so much.
janpot 8y ago
Recently bumped into https://npm.community/t/packages-with-peerdependencies-are-incorrectly-hoisted/4794 https://npm.community/t/packages-with-peerdependencies-are-i... The attitude towards fixing issues ("we won’t be able to fix until we get through an upcoming tree builder rewrite.", yeah right...) is making me want to check out alternatives
DevX101 8y ago
Just moved to Yarn this weekend strictly because npm link (used to link to a local version of a package) doesn't work the way I want it to. Everytime I install a new package my previous `npm link` references break in the node_modules folder. `yarn link` keeps these reference. Just as I expect.
- mattigames 8y ago
  I just add a symlink to the folder inside node_modules (so it doesn't need to be on package.json), not the cleaneast but gets the job done.
Aeolun 8y ago
One thing that comes to mind is the lockfile not actually acting as a lockfile. Running ‘npm install’ updates the lockfile :/ Then there was the issue where it didn’t respect git commit hashes that were added to the lockfile, just taking whatever the latest commit was.

Which part of npm acts unexpectedly?

by h1d 8y ago

Which part of npm acts unexpectedly?

We switched around June last year to yarn because git URL dependencies on branches was broken in npm. It would choose incorrect commit ids inexplicably. Beyond that dependency upgrade time is faster.

dhritzkiv 8y ago

Not that this is a showstopper, but I have issues with the package-lock.json file where the `resolved` field (the package's registry URL) constantly flip flops between http and https protocols, depending on which machine I'm on (home, work, or docker container), whenever I run `npm install`. Sounds not so bad, but it becomes a mess in git, and causes any docker build caches to become invalidated.

scrollaway 8y ago
That sounds pretty bad and I'm not so sure it's a npm bug. Do you have a diff of the change in question? Is it on the npm registry or a custom one?
- dhritzkiv 8y ago
  It's on the npm registry, affecting the npm client: https://npm.community/t/some-packages-have-dist-tarball-as-http-and-not-https/285/51 https://npm.community/t/some-packages-have-dist-tarball-as-h...
jwalton 8y ago
A very similar bug that we run into sometimes: https://npm.community/t/npm-install-or-npm-update-turns-a-bunch-of-resolved-in-package-lock-json-from-real-values-to-false/3308 https://npm.community/t/npm-install-or-npm-update-turns-a-bu...
whatever_dude 8y ago
Oh man, I get that all the time, hate it so much.

janpot 8y ago

Recently bumped into https://npm.community/t/packages-with-peerdependencies-are-incorrectly-hoisted/4794 https://npm.community/t/packages-with-peerdependencies-are-i... The attitude towards fixing issues ("we won’t be able to fix until we get through an upcoming tree builder rewrite.", yeah right...) is making me want to check out alternatives

DevX101 8y ago

Just moved to Yarn this weekend strictly because npm link (used to link to a local version of a package) doesn't work the way I want it to. Everytime I install a new package my previous `npm link` references break in the node_modules folder. `yarn link` keeps these reference. Just as I expect.

mattigames 8y ago
I just add a symlink to the folder inside node_modules (so it doesn't need to be on package.json), not the cleaneast but gets the job done.

Aeolun 8y ago

One thing that comes to mind is the lockfile not actually acting as a lockfile. Running ‘npm install’ updates the lockfile :/ Then there was the issue where it didn’t respect git commit hashes that were added to the lockfile, just taking whatever the latest commit was.