-
Notifications
You must be signed in to change notification settings - Fork 3.7k
Closed
Labels
Bugthing that needs fixingthing that needs fixingRelease 8.xwork is associated with a specific npm 8 releasework is associated with a specific npm 8 release
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
npm ci
will install latest versions, rather than versions from the shrinkwrap, if it is configured with package-lock=false
(and/or shrinkwrap=false
, although I didn't explicitly test what happens when the two don't match - they're aliased, aren't they?)
Expected Behavior
I realize this is a rather edgy case, but npm@6 used to respect the lockfile when running npm ci
regardless of configuration.
npm ci
fails when a lock file is not present, so it feels weird that it would check for the presence of a lockfile, but then entirely ignore its contents.
This might be intentional, in which case I'm sorry, but I don't recall this being mentioned under breaking changes?
Steps To Reproduce
- Have a repo with a lock file
- Configure npm via local
.npmrc
, or global.npmrc
, or env to havepackage-lock=false
- Run
npm ci
Environment
- npm: 8.3.0
- Node: 16.3.1
- OS: macOS
- platform:
- npm config:
; copy and paste output from `npm config ls` here
Metadata
Metadata
Assignees
Labels
Bugthing that needs fixingthing that needs fixingRelease 8.xwork is associated with a specific npm 8 releasework is associated with a specific npm 8 release