Volta: Ignore devDependencies in `volta install`

[timsuchanek]

As of now, Volta looks into the devDependencies of a package, that is being installed through volta install.

However, by definition, these devDependencies don't need to be installed for a library, so it would be great, if volta would ignore these.

This would fix the situation, that a version scheme is being used, which Volta doesn't know, in the linked issue, it's the workspace: version protocol, supported by yarn and pnpm.

It's a separate issue, that this workspace: protocol shouldn't even end up in the devDependencies, which is being tracked here: https://github.com/pnpm/pnpm/pull/2203

[charlespierce]

Hi @timsuchanek, thanks for reporting this. We don't actually install the devDependencies or look at them ourselves, you can see in the original issue this line:

[verbose] Installing dependencies with command: "npm" "install" "--only=production" "--loglevel=warn" "--no-update-notifier" "--no-audit"

The --only=production flag tells npm to only install the dependencies. However, from some testing, it seems like npm still resolves the devDependencies using that command, I'm guessing to support resolving the dependency graph when there is duplication. This causes npm to spit out the error about an unsupported protocol.

Interestingly, running npm i -g prisma2 _doesn't_ cause this error, so it seems that npm uses different logic in that case, which is frustrating 🙁I'm not sure if this qualifies as a bug or as expected behavior in npm.

[charlespierce]

Opened https://github.com/npm/cli/issues/582 to look into the upstream bug in npm itself.

[timsuchanek]

Ok, thanks a lot for creating the issue in npm!
Sounds like indeed they should indeed ignore the devDependencies for that case.

[charlespierce]

While the upstream issue is still open, this should be resolved (for all npm versions) in Volta 0.9.0. We're now using the global install process under the hood, so it should avoid the buggy code path in npm itself.