[BUG] file: dependency is locked without package name when install is run for the 1st time

[mvorisek]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Please run the repro steps below. Currently when a file: dependency is required, it is added to the lock file without a name when the npm install is run for the 1st time. Even if there is no dependency change, when the npm install is rerun, the lock file is changed.

Expected Behavior

no lock file change

Steps To Reproduce

1. git clone https://github.com/atk4/ui.git
2. cd js
3. rm package-lock.json
4. npm i --package-lock-only
5. cp package-lock.json package-lock2.json
6. npm i --package-lock-only
7. notice packages -> .eslint -> name key is added to the lock file (diff package-lock2.json package-lock.json)

Environment

• npm: 9.6.4
• Node.js: v19.8.1
• OS Name: Windows 10 x64

[mvorisek]

Can someone, please, look into this lock file instability issue?

[mvorisek]

Hi all, this issue is still present, can someone please confirm/reproduce it and fix it? Thank you in advance!

[sonallux]

I am also experiencing this issue and have looked into it a bit. The issue is only present when the folder name of the file: dependency is different from the package name.

I have created a reproduction test for this issue in this branch: https://github.com/sonallux/npm/tree/chore/6430-add-reproduction-test-case and opened PR #7228

[milaninfy]

Fixed by #7602