How can I find the NPM package that is blocking a nested dependency from updating? - npm

When I run
npm audit
It tells me I have a critical vulnerability in lodash. When I run
npm ls lodash
I have 47 instances of lodash being deduped.
How can I tell which of my dependencies are holding on to the vulnerable version?


If you temporarily add the vulnerable package at the patched version:
"lodash": ">=4.17.21",
to your package.json and then run npm update <VULNERABLE_PACKAGE> for the vulnerable package. NPM will update all the child dependencies it can.
You can then run npm outdated --depth=5 <VULNERABLE_PACKAGE> and it will show which dependencies are forcing an earlier version.

Related

How to fix "unable to resolve dependency tree" [duplicate]

When trying to install the npm packages using npm i command, I am getting the following exception:
I have tried reinstalling the Node.js package and setting the proxy to off using:
set HTTP_PROXY=
set HTTPS_PROXY=
The issue is still there. What I am doing wrong?
Update:
When I run the following command:
npm install --legacy-peer-deps
The following error is displayed:

This is not related to an HTTP proxy.
You have dependency conflict (incorrect and potentially broken dependency) as it says, so try to run the command with --force, or --legacy-peer-deps. If it doesn't take effect, the temporary solution is using prior versions of the Node.js (downgrading the Node.js version) as it causes this kind of errors to happen sometimes.
Update based on the OP's update:
As you see, it fires the following error:
No matching version found for #angular/http#^9.1.4.
Take a look at angular/http page. Note that the latest version for that deprecated package is 7.2.16 while you request an upper version (e.g., ^9.1.4)! So, try to check the project dependencies and follow the raised errors in order to solve the problem.

Try this command-
npm install --save --legacy-peer-deps

First to understand the problem. Here is what I have as error:
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR!
npm ERR! While resolving: project-admin#11.0.0
npm ERR! Found: #angular/common#11.0.3
npm ERR! node_modules/#angular/common
npm ERR! #angular/common#"11.0.3" from the root project
npm ERR!
npm ERR! Could not resolve dependency:
npm ERR! peer #angular/common#"^9.1.0 || ^10.0.0" from #agm/core#3.0.0-beta.0
npm ERR! node_modules/#agm/core
npm ERR! #agm/core#"3.0.0-beta.0" from the root project
First you should start to read the problem from the bottom to the top. Here #agm/core#3.0.0-beta.0 requires angular common 9.1.0 or 10.0.0. And the top message says that the angular common found is actually 11.0.3.
(If you want to understand dependencies little bit better, here is very simple site: How npm3 Works)
dependencies — these are the essential dependencies that you rely on and call in your project’s code
devDependencies — these are your development dependencies, for example, a prettier library for formatting code
peerDependencies — if you set a peer dependency in your package.json, you are telling the person who installs your package that they need that dependency with the specified version
optionalDependencies — these dependencies are optional and failing to install them will not break the installation process
bundledDependencies — it’s an array of packages that will come bundled with your package. This is useful when some 3rd party library is not on NPM, or you want to include some of your projects as modules
So what should be the solution then? The problem is about peer dependencies. The solution is to downgrade angular common or the solution is to use legacy dependencies logic for installing packages using --legacy-peer-deps. So --legacy-peer-deps does not try to install the peerDependencies automatically. Is this going to work for you? Probably, yes. But you should add specific instructions how to do that, or to make the use of --legacy-peer-deps automatic for future installation of the project packages with this code from one of the previous answers:
npm config set legacy-peer-deps true
In my case I installed the package and I tried to run ng serve, but because --legacy-peer-deps was used, there were dependency packages which were not installed. I had to install those manually (because I did not set the configuration from the code above). At the end installing about five packages manually, all with --legacy-peer-deps, I ended to a package that could not be installed and I did not try to continue, because my project was throwing warnings like crazy and there were a lot of packages for audit too. So my decision was not to use this package and to find an alternative.
Other solutions that I read about along the way:
downgrade Node.js to v14. This will downgrade npm. It might not be v14, but this was the version that was most widely downgraded to.
Some people use Yarn to force package installation - personally I don't understand how this works, because I haven't used Yarn.
downgrading Angular and the global Angular CLI version to version that will satisfy the requirement. In my case it is angular/common, and in the question it's angular/core, but both require downgrading the whole angular right (I am not sure about this here).
the package you install might have a higher version that doesn't require downgrading Angular. You might try to use the https://updatepackagejson.com/ to upgrade your packages to the latest, but this is in case your project is quite new.

In addition to using the --legacy-peer-deps command line option, this can also be set more permanently as a config option:
npm config set legacy-peer-deps true

Finally, I found the answer. Try this command -
npm install --save --legacy-peer-deps
Described here legacy-peer-deps

When using npm 7, this comes up a lot because peer dependencies issues are treated as errors in version 7 whereas they were generally only warnings in version 6. Usually using --legacy-peer-deps makes it work with npm 7.
When that doesn't work, an option is to downgrade to npm 6. Downgrading Node.js is not necessary (but not harmful either). The relevant dependency management code is in npm. Downgrading Node.js will often work coincidentally because doing so will often downgrade npm as well.
Another option that is less disruptive than downgrading npm is using npx to use the previous version of npm for just the install command: npx -p npm#6 npm install
And when all else fails, it's often worth a shot to remove the node_modules directory and package-lock.json, and then run npm install again. That regenerates node_modules and package-lock.json.

This happens for some packages after updating to npm 7.
Parameter --legacy-peer-deps can help:
npm i --legacy-peer-deps
Described here legacy-peer-deps
Causes npm to completely ignore peerDependencies when building a
package tree, as in npm versions 3 through 6.
If a package cannot be installed because of overly strict
peerDependencies that collide, it provides a way to move forward
resolving the situation.
...
You can set this option to true by default (not recommended by npm):
npm config set legacy-peer-deps true
Or just wait until these packages get up to date.

Just do two simple steps:
First, execute this in your terminal.
npm config set legacy-peer-deps true
Second, clear the cache:
npm cache clean --force
And finally, execute your command. This will work for sure.

The problem is related to a dependency conflict or broken dependency. You can proceed by accepting the incorrection of dependency by forcing an install.
Solution: Using command with --force.
Your command will be like npm install --force #your-npm-package.
Note: You can use yarn to install a dependency if it's available in to install with the yarn package manager.

NPM can be used to install and manage versions of dependencies in your projects.
I had it the same issue on React versions in relation with the npm version:
npm error found types/react#16.14.20
So it might be package-versions that need to be installed based on your package.json file.
It gives errors in the npm 7 version and cannot install Node.js modules.
If you will downgrade npm version to 6, those problems will become warnings and the problem will be resolved.
Try to prove this command: npm install -g npm#6
Check if version is already installed: npm --version
Remove and install node_modules package:
a) Remove rm -rf node_modules
b) Install: npm i

Try removing the node modules and package-lock.json file and run command npm install
or
Try npm cache clean --force

First I tried
npm install
It gave me error unable to resolve dependency tree and based on the help information from this command,
Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
I tried this command:
npm install --legacy-peer-deps
And it solved my problem.

Try two options to resolve this issue:
Option 1: Delete folder node_modules folder and file package_lock.json after running:
npm cache clean --force after npm i --force
Option 2: run npm install --save --legacy-peer-deps

The fastest solution: npm install --legacy-peer-deps
Explanation:
In npm versions 3 through 6, peerDependencies were not automatically installed, and would raise a warning if an invalid version of the peer dependency was found in the tree. As of npm v7, peerDependencies are installed by default.
npm docs: peerDependencies
Your dependency contains some peerDependencies that conflict with the root project's dependency.
As it described in the npm ERR log.

Disclaimer: This assumes you're on npm v7
Note: If you follow the instructions of sibling commenters, it will create a user-scoped config that won't sync consistently across teammates / machines / buildbots.
Project-based legacy peer dependencies
You will probably want legacy-peer-deps tied to your project so it proliferates across machines / developers, and doesn't contaminate your other projects.
npm config set legacy-peer-deps true --location project
This will create a local file at .npmrc which you can commit to your repository:
legacy-peer-deps=true
Then afterwards, you can just run:
npm install
Then commit the updated lockfile.
Remember, location, location, location:
per-project configuration (/path/to/my/project/.npmrc, see more):
npm config set legacy-peer-deps true --location project
per-user configuration (defaults to $HOME/.npmrc, see more)
npm config set legacy-peer-deps true --location user
or, as the default location is user anyway:
npm config set legacy-peer-deps true
global configuration (defalts to $PREFIX/etc/npmrc, see more)
npm config set legacy-peer-deps true --location global
or, as --global infers --location global
npm config set legacy-peer-deps true --global
For some projects, fixing dependencies may be non-trivial
In my case, a critical dependency we have a legacy version of wants to pull in webpack v3 (!) - but that's a build dependency of that project's.
The best solution on a short term basis is to use legacy-peer-deps as a hold over.
If you are in a pinch, you could also consider forking the dependency and adjusting its peer dependencies accordingly - them point your project to the fork.

You can install the packages using two ways it is showing this error
ERESOLVE unable to resolve dependency tree
Install the package using npm install and having --legacy-peer-deps
npm install --save --legacy-peer-deps
This is a combination of two commands
a. Set legacy-peer-deps true in npm config
npm config set legacy-peer-deps true
b. Now install packages using npm install
npm install

The problem seems to be that gf-kautomata-pipeline-ui is using Angular 9, while #angular/http requires Angular 7. (#angular/http was deprecated and eventually removed, and all its functionality was moved into #angular/common instead.)
See: https://www.npmjs.com/package/#angular/http
If you're running Angular 9, then
delete #angular/http from your package.json (You don't need it in Angular 9)
Make sure you have #angular/common in your package.json.
Run npm i.
If you're running Angular 7, then open up your package.json and check to make sure all of your Angular packages are no higher than ^7.0.0. You may also need remove gf-kautomata-pipeline-ui, or contact the author of gf-kautomata-pipeline-ui and find out if the library is compatible with Angular 7.

This works for me:
npm install --save --legacy-peer-deps

In my case, I started getting the error (below) after upgrading npm from version 6 to 7.
npm ERR! code ERESOLVE npm ERR! ERESOLVE unable to resolve dependency
tree
...
npm ERR! Fix the upstream dependency conflict, or retry this command with --force, or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
In my case compiling with either --legacy-peer-deps or --force flags resulted in a useless bundle.
So I tried deleting the node_modules, package-lock.json, and bundle using yarn install. This generated a yarn.lock file and created package-lock.json that worked fine in subsequent npm runs.
P.S.: I am using the temporary workaround until npm 7 works fine with my project: after that, I will delete yarn.lock, package-lock.json and folder node_modules, and recompile with npm
rm -rf node_modules
rm package-lock.json
yarn install
# Generates a yarn.lock file and a new package-lock.json
# Continue with npm
npm start

I just update my Node.js and it works for me:
node -v
Output:
V xxxx
And:
sudo npm install -g n
(Use this command to install the stable node release.)
sudo n stable

If you have node_modules folder and package-lock.json file in your root directory then remove those:
rm -r node_modules
rm package-lock.json
Then run commands:
npm install --save --legacy-peer-deps
npm audit fix --force
Create .env file in the root directory and paste below code:
SKIP_PREFLIGHT_CHECK=true
Now, start your project:
npm start

I have faced this issue many times. At last I found a solution:
npm install react-native-paper --legacy-peer-deps

Use
npm install --legacy-peer-deps
This worked for me.

For this case, I was having the issue
ERESOLVE unable to resolve dependency tree
in an Angular 13 project that used some packages from a private npm feed in Azure DevOps.
To access this repository, I created an .npmrc file. Because of this, the npm install command would search all packages in my private repository and not in npm feed any more. The unable to resolve the dependency tree error happened because the npm install command could not find many of the packages that were hosted in the npm feed and not my private feed.
I found this amazing answer on how to scope packages.
Based on this, I made some changes:
In my library Package.json, update the name to have a scope name #mylib
"name": "#myLib/command-queue",
Build and publish this package to my private feed
In my client app (the one that uses this package), update the .npmrc file to use my private feed for packages in this scope only
#myLib:registry=https://pkgs.dev.azure.com/...
always-auth=true
Now, whenever I run the command npm install, if the package has the scope #myLib, it will look for it in my private feed, and use the npm feed for all other cases (i.e., #angular/...)
This is an example of my client app Package.json file:
"#angular/platform-browser-dynamic": "~13.3.0",
"#angular/router": "~13.3.0", <-- this comes from npm
"#myLib/jcg-command-queue": "^2.2.0", <-- This comes from my private feed
Also, with this change, there isn't any need to add --legacy-peer-deps to the npm install command any more.

We had the same issue resulting in the error bellow:
npm ERR! code ERESOLVE npm
ERR! ERESOLVE could not resolve npm
ERR!
npm ERR! While resolving: #angular/material-moment-adapter#12.1.4 npm
ERR! Found: #angular/material#12.0.6 npm ERR!
node_modules/#angular/material npm ERR! #angular/material#"~12.0.4"
from the root project
...
We use npm ci for clean install in Azure-Pipelines.
The issue was very often, that package.json and package-lock.json were not in sync anymore.
Solution to it was to execute npm install local and push the new package-lock.json.
As and additional hint we added a new task in the pipeline for additional informations if the the job fails.
- task: Npm#1
displayName: npm install
inputs:
command: custom
customCommand: ci
customRegistry: useNpmrc
# ##vso[task.logissue type=error] writes the text to the summary page (error-log).
- bash: echo "##vso[task.logissue type=error] If 'npm install' fails with 'ERESOLVE could not resolve', 'package.json' and 'package-lock.json' (needed for 'npm ci') may be out of sync. Run 'npm install' locally and push the new package-lock.json."
condition: failed() # Only execute on fail
displayName: npm install failed hint

Resetting package-lock.json works good for me all the time:
git checkout -- package-lock.json
Details:
Been experiencing this a lot when updating all packages of the legacy project - I highly don't recommend using npm audit fix nor npm i --force. Deleting the package-lock.json didn't work for me all the time as well. Rollback to the working version of package.json + package-lock.json and add packages turned out to be the safest and fastest variant for me.

Just in case, I did have similar behavior, when I tried either npm upgrade my current Angular 11.x based boilerplate from previous ng new or create new ng new abc based on Angular 12.x. I simply forgot to upgrade Angular CLI. So this npm install -g #angular/cli#latest solved my errors during ng new abc.

In my case I was having trouble with a #babel/core dependency, but I didn't want to use --force, because I was not sure about the consequences, so I went to https://www.npmjs.com/, looked for the package and replaced my old version with the newest one. That did the work.

This is an issue of Node.js version. Some latest versions of Node.js could show errors like these.
https://github.com/nvm-sh/nvm
I use NVM to manage Node.js versions on the system and use Node.js 12 to get past this error.
Command to change version:
nvm use 12

Downgrade Node.js to v14 works for me.
Use these commands:
source ~/.bash_profile
nvm use v14.16.1
npm install

NPM: Link peer dependency to package alias

Assume I have legacy codebase working with some old packages:
"mobx": "5.15.4",
"mobx-react": "6.1.8",
While developing some new experimental feature, I wanna use newer versions of these packages, but also have to leave legacy in a working state. So, I'm aliasing newer versions of packages so I can use them alongside with the old ones:
"#new/mobx": "npm:mobx#^6.3.13"
"#new/mobx-react": "npm:mobx-react#^7.2.1"
But mobx-react using mobx as a peer dependency. Obviously, the problem is that #new/mobx-react is watching old mobx version and expectedly says that there should be mobx of version 6+.
Is there any way to manually resolve peer dependency of #new/mobx-react, so it will watch #new/mobx and not just mobx? Or, maybe there is a way to implicitly install peer deps for #new/mobx-react in a way it will not override old mobx version?

You can easily do that
set NODE_ENV=development
npm install mobx#5.15.4 --save
npm install mobx-react#6.1.8 --save
npm install #new/mobx#npm:mobx#^6.3.13 --save
npm install #new/mobx-react#npm:mobx-react#^7.2.1 --save
then you must manually install dependencies for your #new/mobx-react like as follows:
cd ./node_modules/#new/mobx-react
npm install --ignore-scripts
that will lead to mobx of version 6.3.14 be in node_modules of your #new/mobx-react
node.js (starting from npm version 3) at first tries to load dependency from internal node_modules of package, then from node_modules of project see : documentation

Package.json pasting a package name in bad?

What happens differently when you go into your package.json and paste a package name in and do npm i vs. doing it the real npm i package-name?
package.json:
"dep": 1.0.0
vs
npm i dep --save
We have a build error and learned can bypass it by pasting. I know it isn't kosher but I really want to know why and what consequences that causes?

npm install dep doesn't add the dependency to the package.json file.
You have to add --save or --save-dev to add it to the package.json file.
Besides that, npm install will always serve you the latest build (in most cases the version tagged as latest (see npm docs)), unless you specify a specific version.
If you want your lock file to update, you have to delete the file before running npm install to generate a lock file with the dependency included (for more info check out this GitHub issue)
In conclussion it shouldn't make much of a difference if you manually add the dependency to package.json file and install it with npm install, unless the latest version of your dependency is broken.

npm5 equivalent to yarn's --pure-lockfile flag?

I'm looking for an equivalent for yarn's --pure-lockfile flag.
This flag is useful when installing dependencies in CI, when you want it to read your lockfile but not modify it.
Does npm v5 have an equivalent?

npm 5.7 introduced the npm ci subcommand:
the main differences between using npm install and npm ci are:
The project must have an existing package-lock.json or npm-shrinkwrap.json.
If dependencies in the package lock do not match those in package.json, npm ci will exit with an error, instead of updating the package lock.
npm ci can only install entire projects at a time: individual dependencies cannot be added with this command.
If a node_modules is already present, it will be automatically removed before npm ci begins its install.
It will never write to package.json or any of the package-locks: installs are essentially frozen.

this is how I did in my dockerfile
RUN npm install --pure-lockfile
it should work perfect.

How do I force npm to reinstall a single package, even if the version number is the same?

In my Node.js project, I have a dependency on another local project. Oftentimes, I need to make a small change to the dependency and see how it affects my main project. In order to do this, I have to reinstall my dependency using npm.
I can use npm update to try to update my dependency, but this seems like it will only work if the version number has changed on the dependency. I don't want to have to change the version number on my dependency every time I change a line of code or two to make an experimental change in development.
I can rm -rf node_modules/; npm install to ensure that I get the latest versions of all of my dependencies. Downloading all of my non-local dependencies takes several minutes, breaking up my train of thought.
Is there a way to force npm to reinstall a single dependency, even if that dependency's version number hasn't changed?

When you run npm install, it will install any missing dependencies, so you can combine it with an uninstall like this:
npm uninstall some_module; npm install
With npm 5, uninstalled modules are removed from the package.json, so you should use:
npm uninstall some_module; npm install some_module

On npm v 6.14:
npm install module_name --force --no-save
You get a message stating:
npm WARN using --force I sure hope you know what you are doing.
And then it proceeds to uninstall and reinstall the package.
Note: if you don't specify the --no-save option, npm updates the package version on package.json to the highest version that is compatible with the existing SemVer rule.
If you do not want npm to update the package's version on package.json, keep the --no-save option.

Not the best answer, but just for information, you can run
npm ci
It is the same as npm install, but it will remove the existing node_modules folder, if any, and do a fresh install for all packages. This is useful if the files in node_modules have been changed for some reason and you want to revert them to their original state.