[BUG] workspace is not respected when updating package deps

[jasonwilliams]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

• run npm i inside of a workspace folder, instead of updating the top-level package-lock a new one is created. This is the wrong behaviour for workspaces.

I understand that this can be "fixed" by only running said command at the top-level but it's not ideal as its too-easy of a mistake to npm i on a package instead and end up committing the new package-lock.

Yarn & pnpm's handling of this reduces potential bugs by detecting a workspace then updating the top-level package-lock.json only. It shouldn't be too much trouble to adopt that approach.

See below for an example:

 classDiagram
      Workspace <|-- Project A
      Workspace <|-- Project B
      Workspace: package.json
      Workspace: package-lock.json

      class Project A{
          package.json
      }
      class Project B{
          package.json
      }

Loading

• $ cwd projectA
• $ npm i

 classDiagram
      Workspace <|-- Project A
      Workspace <|-- Project B
      Workspace: package.json
      Workspace: package-lock.json

      class Project A{
          package.json
          package-lock.json
      }
      class Project B{
          package.json
      }

Loading

Undefined behavior

Expected Behavior

package-lock is updated inside the workspace folder

Steps To Reproduce

• Clone https://github.com/jasonwilliams/npm-workspace-testcase
• Follow instructions within readme

Environment

• npm: v8.3.0
• Node.js: v17.3.0
• OS Name: Windows (WSL)
• System Model Name:
• npm config:

; node bin location = /home/jasew/.nvm/versions/node/v17.3.0/bin/node
; cwd = /home/jasew/workspace/npm-testcase/project-a
; HOME = /home/jasew
; Run `npm config ls -l` to show all defaults.

RFC: https://github.com/npm/rfcs/blob/main/implemented/0026-workspaces.md

Prior Art

pnpm - https://pnpm.io/workspaces#shared-workspace-lockfile
yarn - https://classic.yarnpkg.com/lang/en/docs/workspaces/#toc-why-would-you-want-to-do-this

[nlf]

this is fixed in npm@8.5.0 with automatic workspace root detection