yarn install --production misses some required transitive dependencies #2263

chrisdarroch · 2016-12-15T10:34:43Z

Running yarn install works fine. yarn install --production should also work, installing only those dependencies needed outside of dev, but it misses some transitive dependencies that are present in the devDependencies section.

Steps to reproduce

Create a new project, using this package.json:

{
  "name": "yarndemo",
  "dependencies": {
    "gulp": "3.9.1",
    "gulp-help": "1.6.1",
    "maven": "^4.0.3",
    "run-sequence": "1.2.2",
    "xml2js": "^0.4.17",
    "yargs": "5.0.0"
  },
  "devDependencies": {
    "eslint": ">=3.3.0",
    "eslint-config-airbnb": "0.1.0",
    "eslint-plugin-react": "3.5.1",
    "stylelint": "^7"
  },
  "engines": {
    "node": ">=6.7.0",
    "npm": "3.10.7"
  },
  "scripts": {
    "postinstall": "npm list --production"
  },
  "private": true
}

Ensure no node_modules directory exists.
Delete yarn.lock if it already exists.
Run yarn install --production.

Expected behavior

Running npm list --production (as done in the postinstall script) should report no missing dependencies.

Actual behaviour

Several transitive dependencies are missing. e.g., error-ex@^1.2.0, minimist@0.0.8, and others.

Notes

This behaviour is consistent regardless of whether the lockfile is present before running the command.

Please mention your node.js, yarn and operating system version.

Using Yarn 0.18.0, Node.js v6.7.0, OSX 10.12.1 (Darwin Kernel Version 16.1.0: Thu Oct 13 21:26:57 PDT 2016; root:xnu-3789.21.3~60/RELEASE_X86_64), and zsh.

The text was updated successfully, but these errors were encountered:

bestander · 2016-12-17T18:40:21Z

Could you check in yarn 0.18.1?

chrisdarroch · 2016-12-19T11:15:26Z

It's much closer to being correct, but still fails on one of the transitive dependencies:

yarn install v0.18.1
info No lockfile found.
[1/4] 🔍  Resolving packages...
warning gulp > vinyl-fs > glob-stream > minimatch@2.0.10: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
warning gulp > vinyl-fs > glob-watcher > gaze > globule > minimatch@0.2.14: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
warning gulp > vinyl-fs > glob-watcher > gaze > globule > glob > graceful-fs@1.2.3: graceful-fs v3.0.0 and before will fail on node releases >= v7.0. Please update to graceful-fs@^4.0.0 as soon as possible. Use 'npm ls graceful-fs' to find it in the tree.
[2/4] 🚚  Fetching packages...
[3/4] 🔗  Linking dependencies...
[4/4] 📃  Building fresh packages...
success Saved lockfile.
$ npm list --production
(snip...)
├─┬ gulp@3.9.1
│ └─┬ vinyl-fs@0.3.14
│   ├─┬ glob-stream@3.1.18
│   │ ├─┬ minimatch@2.0.10
│   │ │ └─┬ brace-expansion@1.1.6
│   │ │   ├── UNMET DEPENDENCY balanced-match@^0.4.1

npm ERR! missing: balanced-match@^0.4.1, required by brace-expansion@1.1.6
error Command failed with exit code 1.

bestander · 2016-12-19T15:11:42Z

Indeed, I can reproduce, looks like we are missing this path for the example package.json:

gulp->vinyl-fs->minimatch->brace-expansion->balanced-match

migueloller · 2016-12-19T16:42:38Z

Here's a discussion that is relevant to this issue: heroku/heroku-buildpack-nodejs#337

And if it helps, here's a diff of what got installed after running yarn --production and then running npm install --production:

EDIT: #761 seems to be relevant as well.

sontek · 2017-01-02T20:14:20Z

This seems related to:

#2141

I've been pinging them to re-open but haven't gotten a response yet.

bestander · 2017-01-03T14:41:59Z

Reopened #2141.
The best thing you can do to speed up the fix is send a PR with a failing test similar to #1754

bestander · 2017-01-14T01:16:50Z

The minimum reproducible package.json is:

{
  "name": "yarndemo",
  "dependencies": {
    "gulp": "3.9.1"
  },
  "devDependencies": {
    "eslint": ">=3.3.0",
    "eslint-plugin-react": "3.5.1",
    "stylelint": "^7"
  }
}

New check --commonjs can catch it now, I`ll add tests and proceed with the fix

bestander · 2017-01-16T20:38:37Z

I can still repro the above issue in latest master:

bestander-pro:2263 bestander$ yarn install --production
yarn install v0.20.0-0
info No lockfile found.
warning yarndemo: No license field
[1/4] 🔍  Resolving packages...
warning gulp > vinyl-fs > glob-stream > minimatch@2.0.10: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
warning gulp > vinyl-fs > glob-watcher > gaze > globule > minimatch@0.2.14: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
warning gulp > vinyl-fs > glob-watcher > gaze > globule > glob > graceful-fs@1.2.3: graceful-fs v3.0.0 and before will fail on node releases >= v7.0. Please update to graceful-fs@^4.0.0 as soon as possible. Use 'npm ls graceful-fs' to find it in the tree.
[2/4] 🚚  Fetching packages...
[3/4] 🔗  Linking dependencies...
[4/4] 📃  Building fresh packages...
success Saved lockfile.
✨  Done in 4.25s.


bestander-pro:2263 bestander$ yarn check --production --verify-tree
yarn check v0.20.0-0
error "gulp#vinyl-fs#glob-stream#minimatch#brace-expansion#balanced-match" not installed
error Found 1 errors.
info Visit https://yarnpkg.com/en/docs/cli/check for documentation about this command.

ebaynaud · 2017-01-19T17:08:18Z

Same issue as #2141 as already said upper. So #2141 should not be closed.

Still an issue with 0.19.1.

And I can provide another very simple package.json and steps to reproduce:

{
  "dependencies": {
    "css-select": "1.2.0"
  },
 "devDependencies": {
    "domutils": "1.5.1"
  }
}

Result:

ebaynaud@McR1 test $ rm -rf node_modules yarn.lock; yarn --prod
yarn install v0.19.1
info No lockfile found.
warning No license field
[1/4] 🔍  Resolving packages...
[2/4] 🚚  Fetching packages...
[3/4] 🔗  Linking dependencies...
[4/4] 📃  Building fresh packages...
success Saved lockfile.
✨  Done in 0.79s.

ebaynaud@McR1 test $ npm ls domutils
/Users/ebaynaud/src/test
└─┬ css-select@1.2.0
  └── UNMET DEPENDENCY domutils@1.5.1

npm ERR! missing: domutils@1.5.1, required by css-select@1.2.0

Without --prod, everything is ok:

ebaynaud@McR1 test $ rm -rf node_modules yarn.lock; yarn
yarn install v0.19.1
info No lockfile found.
warning No license field
[1/4] 🔍  Resolving packages...
[2/4] 🚚  Fetching packages...
[3/4] 🔗  Linking dependencies...
[4/4] 📃  Building fresh packages...
success Saved lockfile.
✨  Done in 0.84s.

ebaynaud@McR1 test $ npm ls domutils
/Users/ebaynaud/src/test
└── domutils@1.5.1

Ok also using --prod but removing the devDependency in package.json:

{
  "dependencies": {
    "css-select": "1.2.0"
  }
}

Result:

ebaynaud@McR1 test $ rm -rf node_modules yarn.lock; yarn --prod
yarn install v0.19.1
info No lockfile found.
warning No license field
[1/4] 🔍  Resolving packages...
[2/4] 🚚  Fetching packages...
[3/4] 🔗  Linking dependencies...
[4/4] 📃  Building fresh packages...
success Saved lockfile.
✨  Done in 0.91s.

ebaynaud@McR1 test $ npm ls domutils
/Users/ebaynaud/src/test
└─┬ css-select@1.2.0
  └── domutils@1.5.1

Hope it can helps to fix that definitely!

…arnpkg#761, yarnpkg#2468, yarnpkg#2263)

yagudaev · 2017-01-24T18:30:48Z

Also having this issue same as reported by @ebaynaud

├─┬ html-webpack-plugin@2.24.1
│ └─┬ pretty-error@2.0.2
│   └─┬ renderkid@2.0.0
│     ├─┬ css-select@1.2.0
│     │ └── UNMET DEPENDENCY domutils@1.5.1
│     └─┬ htmlparser2@3.3.0
│       └── domutils@1.1.6

Seem like this fixes it

$ yarn add domutils@1.5.1

But this should not be required :(.

…2263 (#2537) * Explicitly mark ignored deps of non-ignored packages as non-ignored (#761, #2468, #2263) * Fix style nits

bestander · 2017-01-26T00:17:36Z

Should be fixed in master now, will be released in 0.20 next week

…2468, yarnpkg#2263 (yarnpkg#2537) * Explicitly mark ignored deps of non-ignored packages as non-ignored (yarnpkg#761, yarnpkg#2468, yarnpkg#2263) * Fix style nits

bestander self-assigned this Dec 19, 2016

bestander added the cat-bug label Dec 19, 2016

bestander assigned sebmck Jan 4, 2017

bestander mentioned this issue Jan 16, 2017

yarn install --production doesn't install correct dependencies #761

Closed

bestander added the blocker label Jan 16, 2017

chrisdarroch mentioned this issue Jan 16, 2017

Dependencies not installed in production #2468

Closed

bestander added a commit to bestander/yarn that referenced this issue Jan 17, 2017

added a broken test for yarnpkg#2263

a4d8352

bestander mentioned this issue Jan 17, 2017

added a broken test for #2263 #2473

Merged

bestander added a commit that referenced this issue Jan 17, 2017

added a broken test for #2263 (#2473)

5289157

ebaynaud mentioned this issue Jan 20, 2017

--production seems to miss packages? #2141

Closed

blexrob added a commit to blexrob/yarn that referenced this issue Jan 22, 2017

Explicitly mark ignored deps of non-ignored packages as non-ignored (y…

1246b14

…arnpkg#761, yarnpkg#2468, yarnpkg#2263)

blexrob mentioned this issue Jan 23, 2017

Fix install --production not installing used packages, fixes #2468, #2263 #2537

Merged

bestander pushed a commit that referenced this issue Jan 25, 2017

Fix install --production not installing used packages, fixes #2468, #…

e957e22

…2263 (#2537) * Explicitly mark ignored deps of non-ignored packages as non-ignored (#761, #2468, #2263) * Fix style nits

bestander closed this as completed Jan 26, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

yarn install --production misses some required transitive dependencies #2263

yarn install --production misses some required transitive dependencies #2263

chrisdarroch commented Dec 15, 2016

bestander commented Dec 17, 2016

chrisdarroch commented Dec 19, 2016

bestander commented Dec 19, 2016

migueloller commented Dec 19, 2016 •

edited

Loading

sontek commented Jan 2, 2017

bestander commented Jan 3, 2017

bestander commented Jan 14, 2017

bestander commented Jan 16, 2017

ebaynaud commented Jan 19, 2017

yagudaev commented Jan 24, 2017 •

edited

Loading

bestander commented Jan 26, 2017

yarn install --production misses some required transitive dependencies #2263

yarn install --production misses some required transitive dependencies #2263

Comments

chrisdarroch commented Dec 15, 2016

bestander commented Dec 17, 2016

chrisdarroch commented Dec 19, 2016

bestander commented Dec 19, 2016

migueloller commented Dec 19, 2016 • edited Loading

sontek commented Jan 2, 2017

bestander commented Jan 3, 2017

bestander commented Jan 14, 2017

bestander commented Jan 16, 2017

ebaynaud commented Jan 19, 2017

yagudaev commented Jan 24, 2017 • edited Loading

bestander commented Jan 26, 2017

migueloller commented Dec 19, 2016 •

edited

Loading

yagudaev commented Jan 24, 2017 •

edited

Loading