Skip to content

[BUG] npm install modifies yarn.lock in incorrect ways #5126

@victorb

Description

@victorb

Is there an existing issue for this?

  • I have searched the existing issues

This issue exists in the latest npm version

  • I am using the latest npm

Current Behavior

If you run npm install in a project that has a yarn.lock file, npm changes both the syntax, data and order of yarn.lock file.

Changes I've spotted that shouldn't happen:

  • npm adds double-quotes around everything (is-number@^7.0.0: becomes "is-number@^7.0.0":, version becomes "version" and so on)
  • Registry URLs get overwritten ("https://registry.yarnpkg.com/is-number/-/is-number-7.0.0.tgz#7535345b896734d5f80c4d06c50955527a14f12b" becomes "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz")
  • Order of keys becomes shuffled (yarn.lock has version, resolved, integrity in that order, after npm install, the order becomes integrity, resolved, version)

Expected Behavior

No commands run with npm should modify files npm doesn't have anything to do with, namely yarn.lock which is managed by a different program than npm.

Steps To Reproduce

  1. cd $(mktemp -d) Create new temporary directory for a test project
  2. npm init --yes Create new package.json
  3. npm install --save is-number Add a dependency
  4. yarn install Install dependencies via yarn, creating the yarn.lock file
  5. cp yarn.lock yarn.lock.original Save a copy of the original yarn.lock file
  6. npm install Run npm install again which modifies the yarn.lock file unexpectedly
  7. diff yarn.lock yarn.lock.original show the difference between the npm-modified yarn.lock file with the original one that yarn itself produces

Environment

  • npm: 8.13.2
  • Node.js: v18.4.0
  • OS Name: Arch Linux
  • System Model Name: Desktop
  • npm config:
; "user" config from /home/user/.npmrc

//registry.npmjs.org/:_authToken = (protected)

; node bin location = /home/user/.nvm/versions/node/v18.4.0/bin/node
; node version = v18.4.0
; npm local prefix = /tmp/tmp.YKcr2lMqCS
; npm version = 8.13.2
; cwd = /tmp/tmp.YKcr2lMqCS
; HOME = /home/user
; Run `npm config ls -l` to show all defaults.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Bugthing that needs fixingPriority 1high priority issueRelease 8.xwork is associated with a specific npm 8 release

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions