Bug: npm ci doesn't work with [email protected]

[nicojs]

Strange problem. It seems that npm ci doesn't work with the latest decktape release on linux and windows.

This is probably a bug npm in combination with the npm-shrinkwrap.json file.

This is my thinking

• You've used mac os to release decktape
• npm-shrinkwrap.json includes fsevents, because it is included on mac (and only mac).
• npm install decktape will install decktape ignoring the fsevents, because I'm installing on linux.
• npm ci failed because of a bug.

I'll create an issue over at npm.

In the meantime, is there some way to solve this problem?

[nicojs]

Already found the issue at npm side: npm/cli#7622

[nicojs]

This reminded me of open issue #277... opened #342. I think it is time to lose the shrinkwrap file (or remember why it was important 😉)

[astefanutti]

I vaguely remember some people were having issues with transitive dependencies installed with different versions from those compatible with Decktape. And at the time the suggested solution had been to publish that shrinkwrap file according to:
https://docs.npmjs.com/cli/v10/configuring-npm/package-lock-json#package-lockjson-vs-npm-shrinkwrapjson. I’m not sure what’s the best practice nowadays.

[nicojs]

Shrinkwrap is not common nowadays. It was the only solution to have any influence on dependencies in the past. Since then we have lockfiles and the ability to override dependencies.

If you feel more comfortable you can make it a breaking change (major version bump). I think that is justified

[astefanutti]

Thanks. I think it’s OK from the compatibility perspective. We can release a new minor version and get feedback. It’s still not entirely clear how dependencies would exactly match without the shrinkwrap file when users install decktape. If it turns out users have issues with this, we can releases bug fixes.

[nicojs]

It’s still not entirely clear how dependencies would exactly match without the shrinkwrap file when users install decktape.

They probably won't. You can lock your direct dependency versions (by not specifying a version range, as you're doing), but you don't influence the transient dependencies. However, this is what users expect because this is how the entire node-js ecosystem works. If any issues occur, we always have "overrides" in package.json to help as a workaround.

Are you planning on doing a new minor release soon?

[astefanutti]

Are you planning on doing a new minor release soon?

I’m mostly AFK for the next couple of days. I’ll do a release right after that.