Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

socket npm install/uninstall removes optional peer entries from package-lock.json

Abierto
  • ¿Algo no está bien?
#1,673 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
47/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
node.js, typescript
Área
backend, build-system, cli

Línea de trabajo

Start by tracing the incremental socket npm install and socket npm uninstall paths that update package-lock.json, then compare their handling of entries marked both "optional": true and "peer": true with the from-scratch lockfile path. The issue does not name source files or tests, so locate those entry points and their lockfile tests in the repository. Done means unrelated incremental operations retain these entries and npm ci rejects a lockfile missing required peer entries, consistently with npm.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

Incremental socket npm install <pkg> and socket npm uninstall <pkg> remove every
package-lock.json entry flagged "optional": true, "peer": true (a package present only
to satisfy a peer dependency of an optional dependency). The removal occurs regardless of
which package is installed or uninstalled.

  • Real npm, same operation: entries retained.
  • From-scratch generation (socket npm install --package-lock-only with no lockfile): not
    affected.
  • npm ci on the result: EUSAGE, Missing: <pkg> from lock file.
  • socket npm ci on the result: exits 0 and installs the tree without the peer.

Expected vs. actual

Expected (matches npm) Actual (socket npm)
Lockfile after install / uninstall of an unrelated package "optional": true, "peer": true entries retained Entries removed
socket npm ci on a lockfile missing those entries Fails with EUSAGE, as npm ci does Exits 0 and installs the tree without the peer

Environment

Component Version
Socket CLI 1.12.1 (latest, 2026-10-29); also reproduced on 1.1.94
npm (wrapped by socket npm, and standalone) 11.16.0; also reproduced on 11.19.1 (CLI 1.1.94)
Socket Firewall sfw Free 1.15.4, 1.15.6
Node 24.22.1
OS / arch Linux arm64 (OrbStack)
Registry https://registry.npmjs.org/
Socket auth none (token: (not set))

Minimal reproduction

package.json:

{
  "name": "repro",
  "version": "1.0.0",
  "private": true,
  "dependencies": { "@fontsource/ibm-plex-mono": "^5.3.0" },
  "optionalDependencies": { "react-dom": "18.3.1" }
}

[email protected] declares peerDependencies: { "react": "^18.3.1" }. npm records react
with "optional": true, "peer": true.

# 1. Baseline lockfile (real npm)
npm install --package-lock-only
grep -c '"peer": true' package-lock.json        # 1 (react)

# 2. Uninstall an unrelated package via the Socket CLI
socket npm uninstall @fontsource/ibm-plex-mono --package-lock-only
grep -c '"peer": true' package-lock.json        # 0

# 3. npm ci (real npm)
npm ci --dry-run
# npm error code EUSAGE
# npm error Missing: [email protected] from lock file

# 4. sfw npm ci
sfw npm ci --dry-run                            # EUSAGE, Missing: [email protected]

# 5. socket npm ci
socket npm ci --ignore-scripts                  # exit 0, "added 4 packages"
ls node_modules                                 # js-tokens loose-envify react-dom scheduler

Controls:

  • Step 2 with real npm (npm uninstall @fontsource/ibm-plex-mono --package-lock-only):
    react retained; npm ci passes.
  • Step 2 as socket npm install @fontsource/inter --package-lock-only: react removed;
    same result as uninstall.

Test matrix

Method:

  • Baseline lockfile generated with real npm; the Socket CLI performs only the incremental
    operation.
  • Operations: uninstall @fontsource/ibm-plex-mono, install @fontsource/inter. Neither
    touches the peer packages.
  • Validation of the Socket-produced lockfile: npm ci --dry-run, sfw npm ci --dry-run,
    socket npm ci --ignore-scripts.
  • 2 runs per case and operation; all runs identical.

Socket CLI 1.12.1, npm 11.16.0, sfw 1.15.6:

Case Peer entry flags (baseline) socket npm install / uninstall npm install / uninstall npm ci sfw npm ci socket npm ci
react-dom direct peer retained retained pass pass pass
react-dom + react direct none retained retained pass pass pass
react-dom optional peer, optional removed retained fail fail pass
@napi-rs/wasm-runtime direct peer retained retained pass pass pass
@napi-rs/wasm-runtime + @emnapi/* direct none retained retained pass pass pass
@napi-rs/wasm-runtime optional peer, optional removed retained fail fail pass
  • fail = EUSAGE, Missing: <peer> from lock file.
  • CLI 1.1.94: install/uninstall columns identical on npm 11.16.0 and 11.19.1;
    socket npm ci exit 0 on the broken react-dom lockfile.

Excluded factors:

Factor Evidence
Peer dependency alone peer-only entries retained (rows 1, 4)
Specific package Reproduces with react and @emnapi/*
Prerelease versions Removed @emnapi/core is stable 1.11.3
npm version skew Wrapped and standalone npm identical in each run
Outdated CLI Reproduces on latest release 1.12.1

Original occurrence

  • Project: Astro site, July 2026.
  • Path: astro → build tooling → @napi-rs/[email protected] (optional) → peer
    @emnapi/core ^2.0.0-alpha.3, @emnapi/runtime ^2.0.0-alpha.3.
  • No other dependent on @emnapi/* 2.x, so @emnapi/core, @emnapi/runtime and
    @emnapi/wasi-threads were peer + optional entries.
  • Trigger: socket npm install (3 packages), then socket npm uninstall (2 packages).
    All three entries removed; CI npm ci failed.
  • Current resolution of the same package.json does not reproduce: a newer astro
    dependency requires @emnapi/[email protected] directly, so the entries are no longer
    peer-only.
  • Reproduces with dependencies resolved as of that date:
    npm install --package-lock-only --before=2026-07-30.

Impact

Command Result on the affected lockfile
npm ci fail — EUSAGE, Missing: <peer> from lock file
sfw npm ci fail — same error
socket npm ci pass — installs the tree without the peer
  • The CLI produces the inconsistent lockfile and also passes it on ci. With npm
    aliased to socket npm, local npm ci, npm ci --dry-run and builds all pass; the
    failure surfaces only in environments running real npm (CI).
  • sfw delegates to real npm and is unaffected: it rejected every broken lockfile in the
    matrix.

Related

Not re-verified since the original occurrence. From-scratch lockfiles from the Socket CLI
omitted libc fields that npm records on platform-specific packages:

       "cpu": [ "arm64" ],
+      "libc": [
+        "glibc"
+      ],
       "optional": true,

No effect on npm ci validation. Output is not byte-identical to npm's.

Not tested

  • Mechanism (only the effect is observed).
  • Authenticated CLI, org policies.
  • Peers optional via peerDependenciesMeta rather than via an optional dependency.

Questions

  1. Does the incremental path rebuild the ideal tree, or edit the existing lockfile in
    place? In-place handling that treats "optional": true, "peer": true entries as
    removable would match the observed behaviour.
  2. Why does socket npm ci accept a lockfile that npm ci rejects? This divergence hides
    the defect until CI.
  3. Is the omission of libc fields intentional?

Workaround

Generate and validate lockfiles with real npm, bypassing the wrapper:

/usr/bin/npm install --package-lock-only
/usr/bin/npm ci        # must pass before commit

sfw npm ci is safe locally and in CI; it does not alter npm's behaviour.

Lenguaje dominante
TypeScript
Estrellas
336
Forks
72
Merge medio
1 d 12 h
PR fusionados (30 d)
87

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de SocketDev/socket-cli

Todos los issues de SocketDev/socket-cli

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.