ignore bundleDependencies in package-lock.json

[milahu]

this is necessary to consume lockfiles produced by
npm install --package-lock-only --production

{
  includeDevDeps: false,
  strictOutOfSync: false,
  includeOptionalDeps: true,
}

currently, all options are true by default

[milahu]

no, this is a different issue
pnpm-install-only should ignore bundleDependencies

this seems to be an upstream issue with nodejs-lockfile-parser
which seems to ignore the bundleDependencies field in package-lock.json

version_b=11.0.8
echo "updating package.json"
wget -N https://github.com/webtorrent/bittorrent-dht/raw/v$version_b/package.json
echo "updating package-lock.json"
#npm install --package-lock-only --production
npm install --package-lock-only

with this package-lock.json, pnpm-install-only throws

$ node --trace-uncaught --trace-warnings /nix/store/h0wkc26ngkkldfzlk0a7v6lrc7n6rjsq-pnpm-install-only-0.0.4/bin/pnpm-install-only
[email protected]: install NPM dependencies
file:///nix/store/h0wkc26ngkkldfzlk0a7v6lrc7n6rjsq-pnpm-install-only-0.0.4/opt/pnpm-install-only/node_modules/snyk-nodejs-lockfile-parser/dist/dep-graph-builders/npm-lock-v2/index.js:88
            throw new OutOfSyncError(`${name}@${depInfo.version}`, LockfileType.npm);
                  ^

OutOfSyncError: Dependency @isaacs/string-locale-compare@^1.1.0 was not found in package-lock.json. Your package.json and package-lock.json are probably out of sync. Please run "npm install" and try again.

$ grep @isaacs/string-locale-compare ./pkgs/node-pkgs/bittorrent-dht/package-lock.json
        "@isaacs/string-locale-compare",
        "@isaacs/string-locale-compare": "^1.1.0",

$ grep @isaacs/string-locale-compare ./pkgs/node-pkgs/bittorrent-dht/package.json

package-lock.json

    "node_modules/npm": {
      "version": "9.9.3",
      ...
      "bundleDependencies": [
        "@isaacs/string-locale-compare",
      ],
      ...
      "dependencies": {
        "@isaacs/string-locale-compare": "^1.1.0",
        ...
      },
      ...
    },

    "node_modules/@semantic-release/npm": {
      "version": "10.0.6",
      ...
      "dependencies": {
        ...
        "npm": "^9.5.0",
        ...
      },
      ...
    },

    "node_modules/semantic-release": {
      "version": "21.1.2",
      ...
      "dependencies": {
        ...
        "@semantic-release/npm": "^10.0.2",
        ...
      },
      ...
    },

package.json

  "devDependencies": {
    ...
    "semantic-release": "21.1.2",
    ...
  },

note: bundleDependencies

    "node_modules/npm": {
      "version": "9.9.3",
      ...
      "bundleDependencies": [
        "@isaacs/string-locale-compare",

see also: Advantages of bundledDependencies over normal dependencies in npm