Cli: error invalid bin entry for package

[samhstn]

What / Why

I need to run: npm prune from this line in this Heroku buildpack: https://github.com/gjaldon/heroku-buildpack-phoenix-static/blob/master/lib/build.sh#L137

I experience the following error:

npm ERR! invalid bin entry for package [email protected]. key=jsesc, value=bin/jsesc

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/samhstn/.npm/_logs/2019-12-18T17_08_55_527Z-debug.log

Which produced the following debug log: 2019-12-18T17_08_55_527Z-debug.log

When

The error only occurs when running npm prune when no node_modules are present and it can occur for more than just the jsesc module.

But npm prune works fine when we have installed our node_modules.

Where

The error occurs from a clean build on our Heroku ci and for me locally on my osx machine.

How

From cloning this repository: https://github.com/samhstn/invalid-bin-entry, then running:

cd assets
npm prune

produces the error

---

What should I do to debug this type of error going forward? And how can I get my Heroku buildpack to successfully run the npm prune command?

[nickv2002]

I have a new and very similar and unexplained error in my packaging setup. Hoping for an answer here to clarify what's happening.

This was one of the few places I could even find a reasonable result for:

npm "invalid bin entry"

Which makes me suspect this might be due to some recent change.

[grossmannmartin]

I experience the same issue

[PatrickQuintal]

I'm experiencing the same error message, on NPM: v6.13.4.

My steps to reproduce are different to OP, but I'm assuming its a similar cause.

We use:
npm ci && npm prune --production

This causes
error invalid bin entry for package

Using:
npm install && npm prune --production

Works fine however. I would assume because npm install touches package-lock/package.json whenever it sees fit and is potentially adding something in there to make this all work.

I've traced this back to
https://github.com/npm/bin-links/commit/25a34f905a0144cebcd41e56b6942117b267e005#diff-168726dbe96b3ce427e7fedce31bb0bcR85

Which was added in the v6.13.3 npm release.

I don't particularly understand whats going on right now. I might have a better read later to understand what the actual cause is rather then the symptom.

We shouldn't _revert to v6.13.2_ as 6.13.3 & 6.13.4 are to resolve the bin security flaw;
https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli

I think the best course of action right now is to just not use prune until this gets sorted, most likely after the holiday period. :)
@samhstn @grossmannmartin @nickv2002

@isaacs (because git-blame tells me so :joy: )

[cameronc56]

Having the same issue. Seeing it with varying packages:

+ npm prune
npm ERR! invalid bin entry for package [email protected]. key=portastic, value=bin/portastic

npm ERR! A complete log of this run can be found in:
npm ERR!     /root/.npm/_logs/2019-12-23T21_19_21_377Z-debug.log

[isaacs]

Yeah, looks like prune doesn't pass in the fully resolved folder when it links bins (which, I have to say, why is _prune_ linking bins, that seems somewhat unnecessary, but ok.)

It'll be fixed in the next cli release. In the meantime, you can maybe use npm ci --production to get to the state of "production deps installed, but not dev deps"? That won't be good if you're depending on bundling your deps in the git repo, of course, since ci throws away the existing node_modules if it finds one, but just trying to think of workarounds you might be able to use.

[astroash]

Any news on when this fix will be live?

[isaacs]

6.13.5 will be going out tuesday of next week, 2019-01-07, with an update to pacote and bin-links to fix this and one other issue.

[javiermrz]

Same happening here. Do you know aproximately at what time it will be updated today?

[jwwtaker]

This issue's been driving me nuts the last few days, is there any idea when the fix will go out? its broken all my auto deployments via TeamCity so we're stuck being able to deploy and QA our products.

[isaacs]

Sorry for the delay. Been debugging a weird failure on GH Actions Windows CI. We expect to get this out in the next few days, at the longest.

[javiermrz]

@jwwtaker you can just use the commands in inverse order until the fix comes out:

• npm install
• npm prune

[samhstn]

npm prune still not working for me using npm v6.13.6.

From original description:

From cloning this repository: https://github.com/samhstn/invalid-bin-entry, then running:

cd assets
npm prune

produces the following error:

npm ERR! invalid bin entry for package [email protected]. key=jsesc, value=bin/jsesc

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/samhstn/.npm/_logs/2020-01-13T13_17_57_425Z-debug.log

And the following debug log: 2020-01-13T13_17_57_425Z-debug.log

[jazzzz]

We have the same problem but cannot use these workarounds because the commands are run by the Heroku buildpack. We are stuck at npm 6.13.2 (the issue happens since npm 6.13.3), or we must remove package-lock.json (the issue only happens with this file). npm 6.13.5 does not fix it, neither does npm 6.13.6.

[gregory]

any update on this @isaacs ?

[PabloFerroDev]

My Azure DevOps CI was giving me the same error, so, just in case someone need help to temporarily fix this:

• Add a new task in your pipeline before your npm prune or npm install called "Node.js tool installer"
• Set 13.3.0 as in the "Version Spec" field and re-run.

That worked for me.

[trusktr]

Unlike some people above, updating from npm 6.13.4 to 6.13.6 fixed the issue in my case, so at least we know _some_ problems were fixed. I hope it can be fixed for everyone else too.

After 20 days, at least a progress update would be great.