[BUG] npm v7 breaks itself upon installing itself in --global --production mode.

[DeeDeeG]

Current Behavior:

npm 7 is broken after installing itself in --global --production mode.

Expected Behavior:

npm 7 installing itself in --global --production mode should not cause a broken npm install.

Steps To Reproduce:

From a working, stable release of npm, run the following command twice and you will have a broken install of npm.

• npm install --global --production npm@next-7
• npm install --global --production npm@next-7 (Once more, with feeling!)

At this point, npm has reinstalled itself in a broken way, and no npm subcommands that I've tried will work.

Environment:

• OS: Ubuntu 20.04
• Node: 14.8.0
• npm: 6.14.7 (for bootstrapping this whole process)
• npm: 7.0.0-beta.6 (reinstalling itself in a broken state)

[ljharb]

Why would you be installing in production mode explicitly? Dev deps only show up if you run npm install or npm install --dev.

[DeeDeeG]

I suppose it was from misremembering the facts you just mentioned. Do global installs not include devDependencies?

(EDIT: You appear to be right. I actually can't get npm 6 to install the devDependencies at all in --global mode, even without --production and running with --also=dev. But that's off-topic for this issue.)

In any case, these "steps to reproduce" do not break existing, stable releases of npm, so I consider it a bug in this beta release, regardless of if the command is a sensible one to run.

[DeeDeeG]

For better or for worse, I seem to recall that it's a common thing in various READMEs to tell users to do global package installs with the --production flag.

For example,node-gyp's README.md: https://github.com/nodejs/node-gyp/tree/v7.1.0#option-1

And Node's documentation page: https://nodejs.org/docs/v14.9.0/api/n-api.html#n_api_building

(Probably copy-pasted from windows-build-tools' own README.md, which has since been updated: felixrieseberg/windows-build-tools@4420dc8)

Update: I sent PRs to Node [1] and node-gyp [2] and they're landed. So users in the future won't have the confusion I did about npm install --global --production being a thing you would want to type.

[DeeDeeG]

Update: This still applies, tested with stable [email protected].

If you run npm install -g --production npm@7 twice, you will have a broken npm.

[nlf]

i'm not able to reproduce this, can you try it with 7.0.9?

[DeeDeeG]

Hi @nlf, I am still able to reproduce it with npm 7.0.9 on Node 12 and Node 14, but I mostly cannot reproduce it on Node 15.

Strangely, only once I was able to run the command npm install --global --production npm@7 in Node 14 several times in a row, but this seems to be a fluke. Likewise, I was able to reproduce the issue once on Node 15, but usually I can't on Node 15.

Maybe this is an intermittent issue. And I do think it happens less often on Node 15. I have a mechanical hard drive if that has anything to do with it? (Speculating if it may be a race condition).

[DeeDeeG]

I think this is fixed now, thanks for working on this @nlf!

I tested, and I could not reproduce the bug on the following Node versions:

• 10.23.1
• 12.20.1
• 14.15.4
• 15.6.0
• 16.0.0-nightly20210120e3e054d020

Tested on my macBook, macOS 10.15.7 Catalina.