How to shrinkwrap npm modules without local dependencies - npm

I tried to maintain package.json with the list of node modules dependencies. when I call npm install it installs the node modules.and generates a folder for it in my app. I call the npm shrinkwrap. But this generates the dependency on the local node module
"dependencies": {
"async": {
"version": "0.2.5",
"from": "async#0.2.5",
"resolved": "https://registry.npmjs.org/async/-/async-0.2.5.tgz"
},
when I upload the app to the appfog server it can install from the npm-shrinkwrap.json. So Ideally I want to remove the node modules folder and just pass the shrinkwrap.json file. But it has this "from". I had in the past generated the shrinkwrap & it didn't have the "from" field in there.
How to generate without "from"/ can I just get a shrinkwrap file from package.json. so my app will be leaner. I can maintain all the node module globally.
Thanks

I'm a bit confused by your question.
Shrinkwrap does not install, package, upload or do anything to your dependencies.
All it does is scan your installed node_modules and record the versions (recursively) into a file. Invoking npm install after that file is defined becomes repeatable, which is a principle of software engineering.
"from" was introduced a few months back. The npm shrinkwrap command seems to set it to the URL from which a module was installed. This is probably for portability. npm install takes a module name, consults a registry (whose URL is configurable as an npm config setting) and installs it. I could take the same package.json and npm-shrinkwrap.json, put them on another machine and theoretically get a different result if that machine's npm config settings point it to a different registry. Therefore, embedding the resolved URL in the shrinkwrap file adds an additional level of repeatability to npm install
See the npm config man page for details of setting the registry parameters.
According to npm issue 3145 on github, the "from" setting is known to cause backwards-compatibility issues with pre-1.2.x npm systems. Upgrading is the only resolution.
https://github.com/isaacs/npm/issues/3145

I think that you are looking for shrinkpack: https://www.npmjs.com/package/shrinkpack
from the doc:
Shrinkpack complements the npm shrinkwrap command by maintaining a node_shrinkwrap directory in your project, containing the exact same tarballs that npm install downloads from https://registry.npmjs.org.
The rest of the npm install process is exactly the same. The only difference is that no network activity is necessary when installing and building your project. The node_shrinkwrap directory can be ignored in your editor (much like is done with the node_modules directory) but is instead checked into source control.

Related

How can i prevent NPM to delete locally installed modules from nodes_modules

I have some local modules which are inhouse developed and I copy to my node_modules folder manually.
When I do this they work fine but after I install some other stuff via ng add or npm install the folder is removed. My question is how can I prevent this from happening so I don't have to copy the files again ?
You need to specify your dependencies in package.json or else you cannot rely on them being in node_modules. Various npm commands might remove it, notably npm ci but also others.
If your package is not publicly published, some options are:
Use a non-public registry and publish it there.
Publish it as a scoped package with limited visibility. You will need a paid or organization account on npm for this. Individual accounts are US$7 a month.
Use npm link to "install" it from your local file system.
Use a postinstall or other life cycle script to have npm copy in your packages for you each time after npm ci or npm install is run.
There are likely other options, but those are the ones that come to mind immediately.

Install other package.json dependencies

Simple question : Is it possible, in a package.json, to reference another package.json, and install its dependencies ?
Thank you.
Yes, this is possible, and this is automatically done by npm install.
If you have pkg-a that depends on pkg-b, including pkg-a in your dependencies will install both pkg-a and pkg-b when running npm install. That is because dependencies are actually references to the package.json of other packages. NPM, upon running install, builds a dependency tree of all the packages that are indirectly required by your current project, and installs all of them in the node_modules directory, and keeps track of them all in package-lock.json.
Good question! but this is not possible as you cannot internally reference one json document from another (json is just a document format, it lacks any ability to process logic, import files etc), npm is configured to run using a single package.json file so your best best would be to put all your dependencies in a single package.json file or split your project into two directories with two separate package.json files, two npm installs etc, if for some reason you require your dependencies to be separate. You could then run your two node projects separately and connect via http if you wish.
The only way that you could come close to doing this would be to write an npm start script in the package.json that cds to another directory with a package.json and runs npm install, this would however only install the dependencies in the second directory node-modules/ folder

Solving the 'npm WARN saveError ENOENT: no such file or directory, open '/Users/<username>/package.json'' error

I'm a newbie so please include links to URLs or explain terminologies so I can understand.
I've managed to install 'npm' on a Mac OS (10.13.3) via the terminal, and have installed some packages like SASS using it.
I'm now trying to install sass-mq using npm. I think I've managed to install it, but I'd like a second opinion on what I might have done that was incomplete, or wrong while doing it.
Initially, following the instructions on the sass-mq Github page, I was trying to use:
npm install sass-mq --save
which gave me this error:
npm WARN saveError ENOENT: no such file or directory, open '/Users/<username>/package.json'
npm WARN enoent ENOENT: no such file or directory, open '/Users/<username>/package.json'
npm WARN <username> No description
npm WARN <username> No repository field.
npm WARN <username> No README data
npm WARN <username> No license field.
+ sass-mq#5.0.0
updated 1 package and audited 1 package in 1.67s
found 0 vulnerabilities
Looking around, I realised I'm meant to be using
npm init
..before typing my 'install sass-mq --save' command.
Cool, done that. Next error was this:
package name: (nikhil) sass-mq
version: (1.0.0)
description:
entry point: (index.js)
test command:
git repository:
keywords:
author:
license: (ISC)
About to write to /Users/nikhil/package.json:
{
"name": "sass-mq",
"version": "1.0.0",
"description": "",
"main": "index.js",
"dependencies": {
"sass-mq": "^5.0.0"
},
"devDependencies": {},
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"author": "",
"license": "ISC"
}
Is this OK? (yes)
darwin:~ nikhil$ npm install sass-mq --save
npm ERR! code ENOSELF
npm ERR! Refusing to install package with name "sass-mq" under a package
**npm ERR! also called "sass-mq". Did you name your project the same
npm ERR! as the dependency you're installing?**
I think this is saying that I can't use 'sass-mq' (which is the name of the package, as the name of the local package (?) I'm installing into on my local machine. Some more info here.
So I simply tried this:
**package name: (sass-mq) media-queries-nikhil**
version: (1.0.0)
description:
git repository:
keywords:
author:
license: (ISC)
About to write to /Users/nikhil/package.json:
and it seems to have worked OK.
My question is: Is this the right way I should have done this? How do you usually do this?
Also, I get these warnings - is it OK to ignore them?
npm WARN media-queries-nikhil#1.0.0 No description
npm WARN media-queries-nikhil#1.0.0 No repository field.
I'm creating this question in part so others like me looking for the answer to a similar issue can find an explanation, instead of just commands they need to fix their issue. I found a few similar question-threads, but none that actually explained what was happening and why.
Thanks for reading, I really appreciate any help with this :)
TL;DR: The way you have done it is fine, and you needn't worry about those warnings.
For a more in-depth idea of why npm exists and how it works, read on.
npm stands for Node Package Manager. Packages are a fundamental part of the node ecosystem - they exist to allow you to use other people's solutions to common problems.
However, this can get very confusing, since, because this is an open source community, they are all being released at different times by different people. Also, two different packages that you use may actually be dependent on a third package that is completely unknown to you, and potentially they may even need different versions of that package.
As you can already see, this has the potential to get very messy.
npm helps you deal with these 'dependencies' in a way that is easier to manage and think about, however it is not essential to use npm - you can write a node app where you organise all these different files yourself. That's going to get very confusing, very quickly, however, so there's no real advantage in at least 99% of cases. There are also other package managers - personally I use yarn but they're all trying to do similar things, so that choice is mainly a matter of preference and outside the scope of this discussion.
So when you start a new project, you type npm init and this tells npm to make a file in your folder called package.json that is going to help you organise these dependencies. package.json will hold the information about your own app (which is a package in its own right) and also which packages you have told npm you are going to be using as dependencies in your own project. This is why it asks you all those questions about your package name and description, so that if you ever publish it, people will know who to contact, what it does, what version it is, etc.
It is only important to give this serious thought if you actually intend to publish your package, which is less likely in the case of a website, but very likely if you're making a library. However, as you've already discovered, packages are meant to have unique names, which is why you should call your package something personal to you, so you don't end up with a naming conflict like you did when you tried to name your package the same as a package you were later going to try to install.
So let's create our own package, and install our first dependency (which, remember, is just another package). I'm going to choose time-stamp as a dependency because it's nice and small.
First you will make your project directory. This is just an empty new directory. Let's call it ts. From inside the ts directory, type npm init into your terminal and answer its questions (although I usually just press return to them all,) then look inside the directory and you will see the package.json file. Open the file, and you will see all your package information. And currently that's it.
So now back to the command line and type npm install time-stamp. When it's finished thinking, open package.json again and you will see time-stamp referenced in the list of 'dependencies.' (As of npm 5 it is no longer necessary to use the --save option. npm now assumes this as default. What is the --save option for npm install?)
Back inside the directory, you will also see another file called package-lock.json and a directory called node_modules.
The node_modules directory will contain a directory called time-stamp and that holds all the code that makes time-stamp work. You probably don't need to look in here very often, but you can, and if you look inside the time-stamp directory you will see it has got its own package.json! Open it up and have a look, and there's all the information it needs to install itself. You'll note that it doesn't have any dependencies, but if it did, they would be installed in your node_modules with all of their dependencies as well... and their dependencies... and theirs... If you want to see this in action, try installing the testing framework 'jest. Again, just npm install jest.
Hopefully the whole thing's beginning to make a bit of sense, now...
The lock file is slightly more complicated. What it does is make sure that when you deploy your project onto a new system that you use exactly the same set of dependencies. It needs to do this because the way npm organises things can be dependent on latest release versions, etc, and it would be very annoying if you were to try to deploy your app and it didn't work because your dependencies were behaving in a different way from your development environment!
Having said all this, basically you can ignore it at this stage! It's an important part of npm, but you shouldn't edit it directly unless you really know what you're doing.
Once you have installed your dependency, you will be able to require or import it anywhere in your project, without having to worry about directing it to the correct path in your directory structure. Just require('time-stamp') and it will work just fine!
Finally, and well done for getting this far, it's worth mentioning global installation. Using the -g option - that is npm install time-stamp -g - means that the dependency will be installed in a central node_modules directory somewhere on your computer rather than in your project's node_modules folder. However, you will still need to link it to your project (so that it ends up as a dependency in your package.json) and you would do that by typing npm link time-stamp. Personally I like all my modules to be local to my project, but again this depends on your use-cases and to an extent personal preference.
What this all means is that the combination of your package.json and the lock file is a perfect representation of all the files in your node_modules, and this means that you don't need to have them in your git (or other repository.) You can pull your repository down to a new server, and all you have to do is type npm install and they'll be dragged down from the internet there and then. This becomes much more important when you have a large project, because of all the files involved in your dependencies, but it's a good habit to add 'node_modules' to your .gitignore from day one. But I'm starting to get off topic so maybe I should end here...
This is only intended to be a basic introduction, so I have kept it fairly simple, and I don't want to create an in-depth tutorial, but if you need clarification on any of the points I've made, feel free to comment and I'll make edits if I can!
npm WARN saveError ENOENT: no such file or directory, open '/Users/{username}/package.json'
You don't have a package.json > use npm init
You are in the wrong directory > cd to the folder where your package.json is, like so:
cd C://Dev/MySolution/MyWebProject
and then try again.
npm WARN media-queries-nikhil#1.0.0 No description
npm WARN media-queries-nikhil#1.0.0 No repository field.
Abulifa's answer explains that your project could be published as it's own npm package... In that scenario, these warnings would help warn that your package.json is missing some fields.
If you know you'll never publish as an npm package, and want to hide these warnings, add this to your package.json:
"description": "filling out this field to avoid warnings",
"repository": "not publishing",
"readme": "not publishing",
"license": "not publishing",
Run the following:
npm init -y
That will create the package.json file which you can edit later with proper information.
Reference: https://www.digitalocean.com/community/questions/npm-warn-saveerror-enoent-package-json-not-found
Issue:
npm install fails with below error
npm WARN saveError ENOENT: no such file or directory, open '.../package.json'' error
Cause
npm install will need package.json in the current directory you are in, which is missing.
Solution
Assume there are 2 directories:
C:\dir1_p\ <--------- package.json exists
C:\dir2\ <--------- package.json does not exist
cd C:\dir1_p\
npm intall <---------- PASS, since package.json is present
cd C:\dir2\
npm intall <---------- ERROR, since package.json is Not present (this was my problem)
So, are you in the correct directory when you did npm install?
Case 1: if you are in wrong directory, cd to a directory where package.json exists, then run npm install
Case 2: if you are in correct directory and you want to create a new package.json, then run npm init and press ENTER keys until it is completed, this will create package.json in current directory, now run npm install
Hope this helps someone.
The same issue occurred for me when running:
npm install -g #vue/cli
After much research and experimentation the only thing that worked instead was:
npm install -g #vue/cli#latest
You can't name your project equal the package name that you are trying to install.
Rename your project at the package json and try again or try npm init again and use another name.
One of the major problem could be that you are not at the root file were you should run npm install, make sure you are either at the client folder or the server side and not in some random files or the parent file that doesnt have package.json in them
close the project and reopen it, this will fix the issue

Package.json pasting a package name in bad?

What happens differently when you go into your package.json and paste a package name in and do npm i vs. doing it the real npm i package-name?
package.json:
"dep": 1.0.0
vs
npm i dep --save
We have a build error and learned can bypass it by pasting. I know it isn't kosher but I really want to know why and what consequences that causes?
npm install dep doesn't add the dependency to the package.json file.
You have to add --save or --save-dev to add it to the package.json file.
Besides that, npm install will always serve you the latest build (in most cases the version tagged as latest (see npm docs)), unless you specify a specific version.
If you want your lock file to update, you have to delete the file before running npm install to generate a lock file with the dependency included (for more info check out this GitHub issue)
In conclussion it shouldn't make much of a difference if you manually add the dependency to package.json file and install it with npm install, unless the latest version of your dependency is broken.

How to install npm own local packages?

I have 2 projects(packages) in npm, I want to inject package_A as dependency to package_B. In package_A root folder, I run npm install -g, then npm install it to C:\Users\Myuser\AppData\Roaming\npm\node_moduls\package_A folder. Now in packages.json in package_B I add "package_A": "1.0.0" in dependencies. When in package_B root file I run npm install, its failed package_A#1.0.0 not found.
How can I identified npm to its my own local package?
Notes:
We are a team, then I don't want to address package_A explicitly.
We are using nexus repository manager.
I don't want to publish my projects to http://registry.npmjs.org/.
I'm not 100% clear what you have tried. If you are going to use a custom module for another application you are developing, installing globally won't do the trick. You have to publish that module in npm.
Check this link for more info on publishing in npm
If you have completed the steps correctly, and still no good happens, please check your naming of the module in package.json file.
Instead of typing in the name and version number in package.json file and then npm install, try directly installing in the terminal with --save so that it will automatically be added to package.json file with correct spelling.