[BUG] npm install or npm update sometimes trashes lockfile, setting resolved: false

[taylorjdawson]

Note: I am porting this issue over from the now archived npm.community with the hopes that this issue can get escalated and resolved as it looks like it has been largely overlooked up to this point. Maybe this issue can be set to resolved: true 😉

---

What / Why

• My package-lock.json constantly toggles between:

 "resolved": "https://registry.npmjs.org/tar/-/tar-4.4.1.tgz",
  "resolved": false,

When

• n/a

Where

• n/a

How

Current Behavior

• Running npm install or npm update sometimes trashes the lockfile, setting resolved: false for a number of packages.

Steps to Reproduce

• Run npm install or npm update
• Check package-lock.json for changes

Expected Behavior

• resolve does not switch between false and the URL.

Who

• n/a

References

• https://npm.community/t/constant-resolved-false-toggle/276
• package-lock.json file has erroneous resolved = false fields RocketChat/Rocket.Chat#15408
• https://npm.community/t/npm-install-or-npm-update-turns-a-bunch-of-resolved-in-package-lock-json-from-real-values-to-false/3308
• Updating End Date Field on Campaign Page DoSomething/rogue#974 (comment)

[aduth]

We've been encountering this quite frequently in WordPress/gutenberg lately.

• Build Tooling: Reevaluate "Build Artifacts" NPM install script WordPress/gutenberg#16157 (comment)
• Configure the navigation editor with correct __experimentalFetchLinkSuggestions WordPress/gutenberg#21873 (comment)
• ESLint Plugin: Update ESLint and related deps to 6.8.x WordPress/gutenberg#21424 (comment)
• First pass at I18N-specific ESLint rules WordPress/gutenberg#20555 (comment)
• Framework: Add package-lock precommit check for latest NPM WordPress/gutenberg#21306
• https://wordpress.slack.com/archives/C02QB2JS7/p1588692036240600 (link requires registration)

Some possibly relevant additional details:

• The packages which fluctuate are often "optional": true, or transitive dependencies of an "optional": true (e.g. nopt, node-pre-gyp, fsevents).
• Our project is structured as a monorepository, with many dependencies in package.json defined as local filesystem dependencies.

[jzaefferer]

For anyone else encountering this problem: rm -rf node_modules/ && npm cache clean --force && npm install helped in my case.

[darcyclarke]

npm v6 is no longer in active development; We will continue to push security releases to v6 at our team's discretion as-per our Support Policy.

If your bug is preproducible on v7, please re-file this issue using our new issue template.

If your issue was a feature request, please consider opening a new RRFC or RFC. If your issue was a question or other idea that was not CLI-specific, consider opening a discussion on our feedback repo

Closing: This is an automated message.