Cli: [BUG] npm link updates package.json to point to local directory

[Gameghostify]

Current Behavior:

npm link foo-bar updates package.json to point to the local directory of the foo-bar module instead of just symlinking it

Note that foo-bar is a private package installed from git (git+ssh)

Expected Behavior:

npm link foo-bar creates a symlink in node_modules/ without altering package.json

Steps To Reproduce:

1. $ cd ./foo-bar && npm link

2. $ cd ../other-package && (cat ./package.json | grep "foo-bar")
   
   "foo-bar": "git+ssh://[email protected]:..."
   

3. $ npm link foo-bar

4. $ cat ./package.json | grep "foo-bar"`
   
   "foo-bar": "file:../foo-bar",
   

The package foo-bar is now symlinked to the local foo-bar folder instead of the link in npm root -g

Environment:

• OS: Ubuntu 20.04 (WSL)
• Node: 12.9.0
• npm: 7.0.5 (Has been happening with 7.0.0 - 7.0.5 though)

[jmacura]

I confirm the same experience on Windows 10 1909 with NodeJS 15.0.1.
And I agree that such a behaviour seems undesired to me.

[wesleytodd]

This example should be a full reduced repro:

$ git clone [email protected]:wesleytodd/english-days.git && cd english-days && npm link && cd .. # this is just a dep free test package I use
$ mkdir link-to && cd link-to && npm init -y && npm i english-days
$ cat package.json | grep english-days # "english-days": "^1.0.0"
$ npm link english-days
$ cat package.json | grep english-days # "english-days": "file:../english-days"

Also tried the above link command with --no-save which did not change the behavior and might be another bug.

[Gameghostify]

Workarounds:

1. You could just symlink it manually (ln -s ../foo-bar ./node_modules/foo-bar)
2. You could do the following:

$ cd ./foo-bar && npm link
$ cd ../other-package
$ npm i --no-save "$(npm root -g)/foo-bar"

[ljharb]

Unfortunately symlinking it manually like that won't set up any binary symlinks, nor will it run the appropriate lifecycle scripts.

[ankon]

Also tried the above link command with --no-save which did not change the behavior and might be another bug.

Trying with --no-save was also my first instinct when I saw that npm link modified package.json.

I think this is clearly a change in behavior that minimally needs to be documented in the release notes.

I'm relying on npm link for setting up a complex development environment, and as it stands now that simply won't work. Modifying package.json has a huge potential of me (or anyone using a similar setup) accidentally commiting the change in package.json, and breaking everything.

[Gameghostify]

It would be great to have someone from NPM acknowledge this/give us some kind of a heads-up, I had to revert back to npm@6 because linking anything is a pain, especially when you have to do it often