How to shrinkwrap devDependencies, but not install

Question

I have a bunch of devDependencies needed in order to run test suite and have production dependencies locked down with npm shrinkwrap. The problem is that when I run npm install, only production dependencies are installed, in order to install devDependencies, I have to remove npm-shrinkwrap.json and run it again.

Now if shrinkwrap contains devDependencies as well, they get installed in production, where they are not required. Surely there should be some command line arguments to force only normal dependencies to be installed?

Answer 1

It looks like this feature was recently added in v3.3 of the npm client per the changelog

You'll now be able to run npm install --only=prod to achieve the effect you wish.

Answer 2

EDIT 2016/09/13

I've tested out npm v3.10.8, and this functionality now works as expected. We've shrinkwrapped our devDependencies and can install only prod dependencies when we deploy.

---

I think it's worth mentioning that this feature should start working as expected very soon. According to this github issue, tons of people were running into the same problem, and according to this pull request, it will be in the next release (scheduled for 2016-09-08).

With the pull request merged in, all you would have to do is:

npm i --only=prod

Answer 3

This is fixed in npm 3.10.8; npm install --production shouldn't install dev deps in a shrinkwrap created by npm shrinkwrap --dev: https://github.com/npm/npm/releases/tag/v3.10.8

Answer 4

September, 2016:

As others have mentioned as well, there were some huge efforts to enhance the shrinkwrap feature starting with npm v3.10.8.

Thanks to this, it'll be possible to keep your devDependencies locked while installing only the production dependencies:

npm shrinkwrap --dev
npm install --only=prod

---

2013 answer:

As stated in the NPM docs:

Since npm shrinkwrap is intended to lock down your dependencies for production use, devDependencies will not be included unless you explicitly set the --dev flag when you run npm shrinkwrap. If installed devDependencies are excluded, then npm will print a warning. If you want them to be installed with your module by default, please consider adding them to dependencies instead.

Basically, or you lock down all deps, or only the production deps.

Not even running npm install --dev or npm install --force can transcend the shrinkwrap functionality.

Answer 5

As to npm 5 (I've tried on 5.5.1 and 5.6.0), --production (--only=prod) flag is problematic.

When package-lock.json exists in the folder,

npm shrinkwrap --production

simply changes the file name to npm-shrinkwrap.json.

How I managed to solve this issue is to run:

npm prune --production

and then run:

npm shrinkwrap --production