[BUG] --lockfile-version is not respected when using shrinkwrap and hidden lockfile

[dominykas]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

$ npm shrinkwrap --lockfile-version=2 produces a v3 lockfile.

v8.1.1 used to print a warning, but #3949 changed that.

v8.1.2 just produces a v3 lockfile without any warnings.

Expected Behavior

lockfile-version param/config should be respected.

Steps To Reproduce

0. $ rm -rf npm-shrinkwrap.json (if the shrinkwrap exists - it seems to work OK)
1. $ npm shrinkwrap --lockfile-version=2
2. $ cat npm-shrinkwrap.json | jq .lockfileVersion

Actual: 3
Expected: 2

Environment

• OS: macOS 11.6
• Node: 14.18.1
• npm: 8.1.2

[dominykas]

(removed - this didn't actually work as I described it)

[lukekarrys]

@dominykas I can't reproduce this. Here's what I'm seeing:

❯ cat package.json
{
  "name": "3962",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "volta": {
    "node": "14.18.1",
    "npm": "8.1.2"
  }
}

❯ npm --version
node 8.1.2

❯ node --version
v14.18.1

❯ ls -lha
total 4.0K
drwxr-xr-x  3 lukekarrys staff   96 Oct 29 11:16 .
drwxr-xr-x 45 lukekarrys staff 1.5K Oct 29 11:13 ..
-rw-r--r--  1 lukekarrys staff  278 Oct 29 11:13 package.json

❯ npm shrinkwrap --lockfile-version=2
npm notice created a lockfile as npm-shrinkwrap.json

❯ cat npm-shrinkwrap.json| json .lockfileVersion
2

❯ ls -lha
total 8.0K
drwxr-xr-x  4 lukekarrys staff  128 Oct 29 11:14 .
drwxr-xr-x 45 lukekarrys staff 1.5K Oct 29 11:13 ..
-rw-r--r--  1 lukekarrys staff  195 Oct 29 11:14 npm-shrinkwrap.json
-rw-r--r--  1 lukekarrys staff  278 Oct 29 11:13 package.json

[ljharb]

@lukekarrys off topic, but what is json? Typically jq is what’s used there; I’ve never seen that one before.

[lukekarrys]

what is json

It's this package from the registry: https://www.npmjs.com/package/json. It does less than jq but I tend to use it for simple npm examples since it's easier to install.

[ljharb]

Gotcha; that seems unwise since most people already have jq available and know what it is :-) (that package is not highly used) maybe if the examples used npx it’d be clearer?

[lukekarrys]

maybe if the examples used npx it’d be clearer?

I agree that it should be made clearer and thanks for the reminder since this already come up in our docs: npm/documentation#45

I'm still leaning towards npx json over jq since I want to have as few prerequisites as possible. But we can discuss more over there :)

[dominykas]

Are you sure you had no lockfile to start with?

[lukekarrys]

Are you sure you had no lockfile to start with?

Yes, that's why I showed the output from the initial ls -lha to confirm that. Can you check your .npmrc files? npm config get lockfile-version should show if you have that set somewhere.