Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

nodejs-package-lock-v3: Skip extraneous entries #1090

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

L-as
Copy link

@L-as L-as commented Jan 25, 2025

The motivation was pagedjs-cli, which has the following lock file: https://github.com/pagedjs/pagedjs-cli/blob/d682e19ee5d14bfe07ad1726540e2423ede75a05/package-lock.json#L39

The explanation in https://docs.npmjs.com/cli/v7/commands/npm-prune/ is:

Extraneous packages are those present in the node_modules folder that
are not listed as any package's dependency list.
[..]
In normal operation, extraneous modules are pruned automatically,
so you'll only need this command with the --production flag.
However, in the real world, operation is not always "normal".
When crashes or mistakes happen, this command can help clean up any resulting garbage.

Arguably it's the upstream package-lock.json that's broken, but OTOH, detecting this as an error in dream2nix would take as much code as just ignoring it,
and just ignoring it is probably OK 99% of the time.

At the very least it's more helpful than the previous error you would get, which is an error when it tries to access entry.version.

If the formatting of the code is not according to guidelines, please do say.

The motivation was pagedjs-cli, which has the following lock file:
https://github.com/pagedjs/pagedjs-cli/blob/d682e19ee5d14bfe07ad1726540e2423ede75a05/package-lock.json#L39

The explanation in https://docs.npmjs.com/cli/v7/commands/npm-prune/ is:
> Extraneous packages are those present in the node_modules folder that
> are not listed as any package's dependency list.
> [..]
> In normal operation, extraneous modules are pruned automatically,
> so you'll only need this command with the --production flag.
> However, in the real world, operation is not always "normal".
> When crashes or mistakes happen, this command can help clean up any resulting garbage.

Arguably it's the upstream package-lock.json that's broken,
but OTOH, detecting this as an error in dream2nix would
take as much code as just ignoring it,
and just ignoring it is probably OK 99% of the time.

At the very least it's more helpful than the previous error you would
get, which is an error when it tries to access `entry.version`.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant