Equivalent to yarn install --immutable?

[aaronadamsCA]

Edit: Bug npm/cli#2701 answers my question. npm ci should abort on lockfile mismatch, but currently does not.

Original post:

yarn install --immutable is an ideal command to invoke when rebuilding a containerized development environment, because it never modifies the lockfile; it aborts if the lockfile was to be modified; and if node_modules/ already matches the lockfile, it exits in 1-2 seconds.

I would prefer to use NPM instead of Yarn, but I haven't been able to find a command that works the same way:

• npm ci always recreates node_modules/. This is expected, but it increases repeat execution time exponentially.
• npm install often modifies package-lock.json.
• npm install --no-save doesn't install from the lockfile, and doesn't abort if the lockfile doesn't match the package.json dependencies.

Does npm install have an immutable "frozen lockfile" mode? If not... could it?

Sorry, I'm sure this question has been asked before, but I haven't found anything helpful.

[ljharb]

The third one surprises me - are you sure it doesn’t install from the lockfile?

[aaronadamsCA]

Yes. I tested by removing dependencies from package.json and running npm install --no-save. The dependencies were removed from node_modules/ without complaint, despite still being present in the lockfile.

I am using version 7.15.1 with workspaces.

I do think the current behaviour of --no-save is acceptable, as it's doing exactly what it says on the box: installing without saving. (Note, however, this specific functionality appears to be undocumented; --no-save is documented only as a flag for npm install [<@scope>/]<name>, not for npm install with no arguments.)

Unfortunately its behaviour doesn't serve my use case, which may be somewhat common as the monorepo ecosystem begins to shift back from Yarn to NPM.

[ljharb]

Does npm install remove them from the lockfile?

If so, then it sounds like it is obeying the lockfile, it's just not persisting the changes npm install is expected to make from it.

npm ci is the "frozen lockfile" mode you're asking for.

[aaronadamsCA]

Does npm install remove them from the lockfile?

Sorry, I don't understand what you're asking, could you clarify?

npm ci is the "frozen lockfile" mode you're asking for.

Yes, except for two big differences:

1. It tolerates an outdated lockfile, which isn't ideal in CI environments. This appears to be a bug: [BUG] npm ci succeeds when package-lock.json doesn't match package.json cli#2701
2. It rebuilds node_modules/ from scratch every time, which isn't ideal in development environments.

In both cases, the specific behaviour of yarn install --immutable is preferable.

I am guessing the answer might be that NPM cannot currently replicate these Yarn behaviours, in which case I think it would be a good idea to look at how NPM could be improved to solve for these use cases. Given NPM has separate install vs. ci commands:

1. npm ci could probably use a flag to verify the lockfile.
2. npm install could probably use a flag to install from the lockfile without the "clean state" provided by npm ci.

(Of course, if there's a way to get either command to behave this way today, I'd want to know about it!)

[aaronadamsCA]

This open bug explains most of my confusion here:

npm/cli#2701

I'd still like to see a frozen lockfile install that works as quickly as Yarn v2, I can file that feature request separately.

[carlgieringer]

Did you end up filing that feature request? It seems silly that the only built-in way npm provides to check whether package-lock.json is up-to-date with package.json (including workspaces) is npm ci. npm ci reinstalls everything from scratch which is slow and makes it toilsome to include as part of frequently run local development checks. (For now I guess there's npx package-lock-utd as a workaround?)

[aaronadamsCA]

These days we've switched to pnpm, which has pnpm install --frozen-lockfile. It's a good implementation I think the NPM CLI would do well to borrow from!