[BUG] Removing dependency from workspace package leads to invalid lockfile

[protyposis]

Current Behavior:

When removing a dependency from a workspace package's package.json and executing npm install in the workspace root to update its package-lock.json (as discussed in #2036 and #1984), the file structure ends up in an invalid state where the version property holds the URL from the resolved property, instead of removing the whole dependency block. See this changeset after npm install:

Expected Behavior:

package-lock.json is in a valid state and all artifacts of the removed dependency are removed from the lockfile.

Steps To Reproduce:

• remove dependency from workspaceRoot/packages/package-a/package.json
• execute npm install in workspaceRoot/
• investigate changes to lockfile

Environment:

• OS: Windows 10
• Node: 12.19.0
• npm: 7.0.10

[protyposis]

Fixed in 7.1.1, thanks!

[petermikitsh]

I'm observing this in 7.5.4; see #2706