socket npm install/uninstall removes optional peer entries from package-lock.json

Offen

#1,673 erstellt am 29.10.2026 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit: 4/5
Geschätzter Aufwand: 3-5 Tage
Anfängerfreundlichkeit: 47/100

Issue-Typ: Bug
Klarheit: Größtenteils klar
Aktivitätsstatus: Aktiv
Tech-Stack: node.js, typescript
Bereich: backend, build-system, cli

Rechercherichtung

Start by tracing the incremental socket npm install and socket npm uninstall paths that update package-lock.json, then compare their handling of entries marked both "optional": true and "peer": true with the from-scratch lockfile path. The issue does not name source files or tests, so locate those entry points and their lockfile tests in the repository. Done means unrelated incremental operations retain these entries and npm ci rejects a lockfile missing required peer entries, consistently with npm.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Summary

Incremental socket npm install <pkg> and socket npm uninstall <pkg> remove every
package-lock.json entry flagged "optional": true, "peer": true (a package present only
to satisfy a peer dependency of an optional dependency). The removal occurs regardless of
which package is installed or uninstalled.

Real npm, same operation: entries retained.
From-scratch generation (socket npm install --package-lock-only with no lockfile): not
affected.
npm ci on the result: EUSAGE, Missing: <pkg> from lock file.
socket npm ci on the result: exits 0 and installs the tree without the peer.

Expected vs. actual

	Expected (matches npm)	Actual (`socket npm`)
Lockfile after `install` / `uninstall` of an unrelated package	`"optional": true, "peer": true` entries retained	Entries removed
`socket npm ci` on a lockfile missing those entries	Fails with `EUSAGE`, as `npm ci` does	Exits 0 and installs the tree without the peer

Environment

Component	Version
Socket CLI	`1.12.1` (latest, 2026-10-29); also reproduced on `1.1.94`
npm (wrapped by `socket npm`, and standalone)	`11.16.0`; also reproduced on `11.19.1` (CLI `1.1.94`)
Socket Firewall	`sfw` Free `1.15.4`, `1.15.6`
Node	`24.22.1`
OS / arch	Linux arm64 (OrbStack)
Registry	`https://registry.npmjs.org/`
Socket auth	none (`token: (not set)`)

Minimal reproduction

package.json:

{
  "name": "repro",
  "version": "1.0.0",
  "private": true,
  "dependencies": { "@fontsource/ibm-plex-mono": "^5.3.0" },
  "optionalDependencies": { "react-dom": "18.3.1" }
}

[email protected] declares peerDependencies: { "react": "^18.3.1" }. npm records react
with "optional": true, "peer": true.

# 1. Baseline lockfile (real npm)
npm install --package-lock-only
grep -c '"peer": true' package-lock.json        # 1 (react)

# 2. Uninstall an unrelated package via the Socket CLI
socket npm uninstall @fontsource/ibm-plex-mono --package-lock-only
grep -c '"peer": true' package-lock.json        # 0

# 3. npm ci (real npm)
npm ci --dry-run
# npm error code EUSAGE
# npm error Missing: [email protected] from lock file

# 4. sfw npm ci
sfw npm ci --dry-run                            # EUSAGE, Missing: [email protected]

# 5. socket npm ci
socket npm ci --ignore-scripts                  # exit 0, "added 4 packages"
ls node_modules                                 # js-tokens loose-envify react-dom scheduler

Controls:

Step 2 with real npm (npm uninstall @fontsource/ibm-plex-mono --package-lock-only):
react retained; npm ci passes.
Step 2 as socket npm install @fontsource/inter --package-lock-only: react removed;
same result as uninstall.

Test matrix

Method:

Baseline lockfile generated with real npm; the Socket CLI performs only the incremental
operation.
Operations: uninstall @fontsource/ibm-plex-mono, install @fontsource/inter. Neither
touches the peer packages.
Validation of the Socket-produced lockfile: npm ci --dry-run, sfw npm ci --dry-run,
socket npm ci --ignore-scripts.
2 runs per case and operation; all runs identical.

Socket CLI 1.12.1, npm 11.16.0, sfw 1.15.6:

Case	Peer entry flags (baseline)	`socket npm` install / uninstall	npm install / uninstall	`npm ci`	`sfw npm ci`	`socket npm ci`
`react-dom` direct	`peer`	retained	retained	pass	pass	pass
`react-dom` + `react` direct	none	retained	retained	pass	pass	pass
`react-dom` optional	`peer`, `optional`	removed	retained	fail	fail	pass
`@napi-rs/wasm-runtime` direct	`peer`	retained	retained	pass	pass	pass
`@napi-rs/wasm-runtime` + `@emnapi/*` direct	none	retained	retained	pass	pass	pass
`@napi-rs/wasm-runtime` optional	`peer`, `optional`	removed	retained	fail	fail	pass

fail = EUSAGE, Missing: <peer> from lock file.
CLI 1.1.94: install/uninstall columns identical on npm 11.16.0 and 11.19.1;
socket npm ci exit 0 on the broken react-dom lockfile.

Excluded factors:

Factor	Evidence
Peer dependency alone	`peer`-only entries retained (rows 1, 4)
Specific package	Reproduces with `react` and `@emnapi/*`
Prerelease versions	Removed `@emnapi/core` is stable `1.11.3`
npm version skew	Wrapped and standalone npm identical in each run
Outdated CLI	Reproduces on latest release `1.12.1`

Original occurrence

Project: Astro site, July 2026.
Path: astro → build tooling → @napi-rs/[email protected] (optional) → peer
@emnapi/core ^2.0.0-alpha.3, @emnapi/runtime ^2.0.0-alpha.3.
No other dependent on @emnapi/* 2.x, so @emnapi/core, @emnapi/runtime and
@emnapi/wasi-threads were peer + optional entries.
Trigger: socket npm install (3 packages), then socket npm uninstall (2 packages).
All three entries removed; CI npm ci failed.
Current resolution of the same package.json does not reproduce: a newer astro
dependency requires @emnapi/[email protected] directly, so the entries are no longer
peer-only.
Reproduces with dependencies resolved as of that date:
npm install --package-lock-only --before=2026-07-30.

Impact

Command	Result on the affected lockfile
`npm ci`	fail — `EUSAGE`, `Missing: <peer> from lock file`
`sfw npm ci`	fail — same error
`socket npm ci`	pass — installs the tree without the peer

The CLI produces the inconsistent lockfile and also passes it on ci. With npm
aliased to socket npm, local npm ci, npm ci --dry-run and builds all pass; the
failure surfaces only in environments running real npm (CI).
sfw delegates to real npm and is unaffected: it rejected every broken lockfile in the
matrix.

Not re-verified since the original occurrence. From-scratch lockfiles from the Socket CLI
omitted libc fields that npm records on platform-specific packages:

       "cpu": [ "arm64" ],
+      "libc": [
+        "glibc"
+      ],
       "optional": true,

No effect on npm ci validation. Output is not byte-identical to npm's.

Not tested

Mechanism (only the effect is observed).
Authenticated CLI, org policies.
Peers optional via peerDependenciesMeta rather than via an optional dependency.

Questions

Does the incremental path rebuild the ideal tree, or edit the existing lockfile in
place? In-place handling that treats "optional": true, "peer": true entries as
removable would match the observed behaviour.
Why does socket npm ci accept a lockfile that npm ci rejects? This divergence hides
the defect until CI.
Is the omission of libc fields intentional?

Workaround

Generate and validate lockfiles with real npm, bypassing the wrapper:

/usr/bin/npm install --package-lock-only
/usr/bin/npm ci        # must pass before commit

sfw npm ci is safe locally and in CI; it does not alter npm's behaviour.

Vorherrschende Sprache: TypeScript
Sterne: 336
Forks: 72
Ø Merge: 1 T. 12 Std.
Gemergte PRs (30 T.): 87

Entwicklungsumgebung

Kein Dockerfile und keine Docker-Compose-Datei
Keine Pull-Request-Vorlage
Beitragsleitfaden lesen

Erste Schritte

Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
Forken Sie das Repository und arbeiten Sie in einem Branch.
Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus SocketDev/socket-cli

socket pnpm add / socket yarn add scan the alias name instead of the aliased package
Offen
- Stimmt etwas nicht?
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 85/100

SocketDev/socket-cli#1655 · Erstellt am 25.10.2026

Maintainer antworten meist innerhalb von 1 Tag
socket npm run build crashes with ERR_MISSING_OPTION: --permission on Node v24 + Next.js
Offen
- Stimmt etwas nicht?
bug

Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 78/100

SocketDev/socket-cli#1160 · 1 Kommentar · Erstellt am 04.4.2026

Maintainer antworten meist innerhalb von 1 Tag
socket fix (NuGet): packages pruned by the .NET 10 SDK are reported as vulnerable; fixes are useless and misreported
Offen
- Stimmt etwas nicht?
Schwierigkeit 4/5 3-5 Tage Anfängerfreundlichkeit 48/100

SocketDev/socket-cli#1675 · Erstellt am 30.10.2026

Maintainer antworten meist innerhalb von 1 Tag
socket fix (NuGet, CPM + lock files): a valid fix is reported as failed because unrelated projects sharing Directory.Packages.props are checked for the package
Offen
- Stimmt etwas nicht?
Schwierigkeit 4/5 3-5 Tage Anfängerfreundlichkeit 55/100

SocketDev/socket-cli#1674 · 1 Kommentar · Erstellt am 30.10.2026

Maintainer antworten meist innerhalb von 1 Tag
`socket npm outdated --json` appends an error object after valid JSON when npm exits with code 1
Offen
- Stimmt etwas nicht?
Schwierigkeit 3/5 1-2 Tage Anfängerfreundlichkeit 65/100

SocketDev/socket-cli#1656 · Erstellt am 25.10.2026

Maintainer antworten meist innerhalb von 1 Tag

Alle Issues in SocketDev/socket-cli

socket npm install/uninstall removes optional peer entries from package-lock.json

Bewertung

Rechercherichtung

Beschreibung

Summary

Expected vs. actual

Environment

Minimal reproduction

Test matrix

Original occurrence

Impact

Related

Not tested

Questions

Workaround

Entwicklungsumgebung

Erste Schritte

Mehr aus SocketDev/socket-cli

Ähnliche Issues

socket npm install/uninstall removes optional peer entries from package-lock.json

Stimmt etwas nicht?

Bewertung

Rechercherichtung

Beschreibung

Summary

Expected vs. actual

Environment

Minimal reproduction

Test matrix

Original occurrence

Impact

Related

Not tested

Questions

Workaround

Entwicklungsumgebung

Erste Schritte

Mehr aus SocketDev/socket-cli

Stimmt etwas nicht?

Stimmt etwas nicht?

Stimmt etwas nicht?

Stimmt etwas nicht?

Stimmt etwas nicht?

Ähnliche Issues

Stimmt etwas nicht?

Stimmt etwas nicht?

Stimmt etwas nicht?

Stimmt etwas nicht?

Stimmt etwas nicht?

Neue Issues direkt in Ihr Postfach