Lerna does not strip local packages from bundledDependencies in tempJson

[rix0rrr]

When trying to bundle local (private) dependencies into another package, package.json looks like this:

{
  "dependencies": {
    "external-dep": "^1.2.3",
    "local-dep": "^4.5.6"
  },
  "bundledDependencies": [
    "local-dep"
  ]
}

During lerna bootstrap, lerna rewrites this to:

{
  "dependencies": {
    "external-dep": "^1.2.3"
  },
  "bundledDependencies": [
    "local-dep"
  ]
}

Which causes the npm install to fail, since local-dep does not exist up on NPM. Correct behavior would have been to remove the local package from bundledDependencies as well.

The bug does not show with packages that have been published to NPM, because they will be installed as normal and then the downloaded package is replaced with a symlink by lerna link later on, but there is no recourse if you do not want to publish the package to NPM (or if you need your Lerna build to pass first on the CI server before the publish to NPM will happen).

Reproduction

.
├── lerna.json
├── package.json
└── packages
    ├── consumer
    │   └── package.json
    └── mytoolspackage
        └── package.json

Package contents here: https://gist.github.com/rix0rrr/a05bd6b30e5364401cddce7bd6efe129

$ npm install && node_modules/.bin/lerna --version && node_modules/.bin/lerna bootstrap
(...npm garbl...)

3.4.3
lerna notice cli v3.4.3
lerna info Bootstrapping 2 packages
lerna info Installing external dependencies
lerna ERR! npm install --no-package-lock exited 1 in 'consumer'
lerna ERR! npm install --no-package-lock stderr:
npm ERR! code E404
npm ERR! 404 Not Found: mytoolspackage@*

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/local/ANT/huijbers/.npm/_logs/2018-11-12T10_57_09_711Z-debug.log

lerna ERR! npm install --no-package-lock exited 1 in 'consumer'

[rix0rrr]

This seems to be a regression because lerna 2.8 did not have this behavior.

[mikea]

Is there any workaround for this?

[evocateur]

@rix0rrr Yes, this is a "regression" in the sense that lerna 2.x half-obliterated the original package.json, only preserving dependencies and devDependencies. Lerna 3.x is less destructive, but apparently bundledDependencies slipped by (I'm not sure how you'd ensure the bundled local dep was actually the local code and not the registry version?).

@mikea Short of not using bundledDependencies, no, there is no workaround as yet in lerna 3.x.

[evocateur]

In terms of a fix, filtering out local package names should be inserted here, before the dependency range filter loops. Since bundledDependencies is just a list, it might look something like this:

// remove local dependencies from bundledDependencies, otherwise `npm install` breaks
if (json.bundledDependencies) {
  json.bundledDependencies = json.bundledDependencies.filter(depName => depMap.has(depName));
}

[lock]

This thread has been automatically locked because there has not been any recent activity after it was closed. Please open a new issue for related bugs.