Angular-cli: npm-shrinkwrap.json handles metadata inconsistently

Created on 17 Jun 2016 · 7Comments · Source: angular/angular-cli

With the change to leveraging shrinkwrap in angular-cli 1.0.0-beta.6 (from registry.npmjs.org), our builds started failing because shrinkwrap is forcing our npm client to try and resolve formly's dependencies from https://registry.npmjs.org (based on the resolved field). This may seem ok on the surface, but it completely breaks users who leverage a private npm repo (e.g. we're using Artifactory as our NPM repo).

Digging around a bit, I found some interesting issues filed on npm related to this:
npm/npm#6444
npm/npm#3581

Based on the comments in these threads, it sounds like:
a) shrinkwrap isn't really bulletproof
b) is probably not appropriate for libraries (at least in its current form).

Versions. Please run ng --version. If there's nothing outputted, please
angular-cli: 1.0.0-beta.6
node: 6.2.1
os: win32 x64

1 (urgent) bufix

Source

flegros

Most helpful comment

I had the same problem as described above. I was able to get around it by adding in the "--no-shrinkwrap" flag (npm install angular-cli -g --no-shrinkwrap), but it was still a little confusing.

patorjk on 1 Jul 2016

👍2

All 7 comments

@hansl can you have a look?

filipesilva on 17 Jun 2016

I had the same problem as described above. I was able to get around it by adding in the "--no-shrinkwrap" flag (npm install angular-cli -g --no-shrinkwrap), but it was still a little confusing.

patorjk on 1 Jul 2016

👍2

Thanks for the tip patorjk, install works for me too. (with the beta.6 and beta.8)

flegros on 4 Jul 2016

👍1

Hi, work for me too (beta.8)

choucry13 on 5 Jul 2016

Hi guys, I wanna test removing all URLs from the shrinkwrap file before publishing, but this skipped the latest release (beta.9). The only goal of the shrinkwrap is to fix the versions of dependencies, so there's no need to force a URL. I'll see what I can do for beta 10.