[BUG 8.6] overrides field not working, not updating after npm install

[trusktr]

Is there an existing issue for this?

• I have searched the existing issues

Related: #4232
Possible dupe of: #4727

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

I put this in my package.json:

{
	"overrides": {
		"three": "$three"
	}
}

however after rm -rf node_modules && npm install I see this:

❯ npm ls three
first-person-shooter@ /home/trusktr/src/lume+lume/apps/first-person-shooter
├─┬ [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected] deduped
│ └── [email protected] invalid: "trusktr/three.js#fix-ray-intersection-without-material" from node_modules/lume
└── [email protected] (git+ssh://[email protected]/trusktr/three.js.git#cd46ade0b331aa19c1e990e1b8ccedd4db3d89c6)

❯ find -L . | grep -E "node_modules/three\$"
./node_modules/lume/node_modules/three
./node_modules/three

And as you can see, there is not a single version of three installed as the documentation for overrides seems to explain.

Expected Behavior

It should override for all packages, and there should be a single three package in node_modules.

Steps To Reproduce

git clone https://github.com/LUMECraft/first-person-shooter.git
cd first-person-shooter
git checkout npm-cli-issue-4732
# look at package.json overrides
npm install
npm ls three
# see output
find -L . | grep -E "node_modules/three\$"
# see output

Environment

• npm: 8.6.0
• Node.js: 17.3.0
• OS Name: Linux Pop_OS
• npm config:

; "builtin" config from /home/trusktr/.npm-packages/lib/node_modules/npm/npmrc

globalignorefile = "/etc/npmignore" 
; prefix = "/usr/local" ; overridden by user

; "user" config from /home/trusktr/.npmrc

//registry.npmjs.org/:_authToken = (protected) 
prefix = "/home/trusktr/.npm-packages" 

; node bin location = /home/trusktr/.n-node-versions/bin/node
; cwd = /home/trusktr/src/lume+lume/apps/first-person-shooter
; HOME = /home/trusktr
; Run `npm config ls -l` to show all defaults.

[trusktr]

Added a reproduction

[trusktr]

I can confirm as in #4727 that rm -rf node_modules package-lock.json && npm install does the trick (needed to also delete the lock file).

But unlike the title of #4727, subsequent npm installs continue to work after originally deleting package-lock.

In the above reproduction, then proceed to run these lines:

rm -rf node_modules package-lock.json && npm install
npm ls three # output is good now
find -L . | grep -E "node_modules/three\$" # one three package is visible, good
npm install
npm ls three # output is still good
find -L . | grep -E "node_modules/three\$" # one three package is visible, good
rm -rf node_modules && npm install
npm ls three # output is still good
find -L . | grep -E "node_modules/three\$" # one three package is visible, good

[trusktr]

To be honest, I always wished npm install fully respected package-lock.json (similar to what npm ci does), and that npm install would never every update things unless an extra flag was passed, f.e. npm install --update.

That would be so much more intuitive.

[nlf]

I'm no longer able to reproduce this as of [email protected], can you give that a try @trusktr?

[darcyclarke]

@trusktr closing this. Please reopen if you're still having issues & can provide a reproduction case.