Yarn: devDependencies and hoisting problem

[bestander]

Npm3 does not hoist devDependencies because hoisting of devDependencies will affect the overall node_modules structure of regular dependencies.
Then npm install --prod and --dev may have possibly different application node_modules and it may cause unexpected app behaviour.

Any idea if this issue affects us and whether we should do the same?

[sebmck]

One way we could fix this would be to ignore devDependencies in the linking phase when in prod mode, we'd still have to fetch all the modules to resolve them and everything but it's probably not that bad (lockfile mitigates network io).

[bestander]

I like the idea

[shayne]

This issue was brought up recently when a react-oss-js test assumed that it could copy the "react" module out of react-native-github/node_modules/ and it would contain its dependencies. This wasn't the case due to the hoisting approach we currently have.

The test itself was questionably implemented so it shouldn't be a nail in the coffin for the way we currently handle devDependencies, rather, another data-point.

[sebmck]

npm (to my knowledge) doesn't handle devDependencies differently by not hoisting them so I'm not sure why this behaviour should be relied on?

[bestander]

I'll find a link tomorrow, I think I came around this issue on GitHub/npm.

On Thursday, 7 July 2016, Sebastian McKenzie [email protected]
wrote:

npm (to my knowledge) doesn't handle devDependencies differently by not
hoisting them so I'm not sure why this behaviour should be relied on?

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/facebook/fbkpm/issues/91#issuecomment-230940394, or mute
the thread
https://github.com/notifications/unsubscribe/ACBdWEP85X8f3Bj3MxngUecCOHeaLZxDks5qTD3CgaJpZM4JEhYd
.

[bestander]

You are right, @kittens, I was misguided that this is the behaviour of npm 3 but it is not.
However there are discussions about this situation https://github.com/npm/npm/issues/11287

[bdentino]

sorry to drudge up an old issue, but was there ever any further discussion of this? is it possibly related to #1462? There seems to be a discrepancy between how yarn and npm hoist modules that are shared by packages specified in dependencies and devDependencies when installing with --production. I've been running into situations where yarn install --prod results in 'module not found' errors because a dependency of a dependency isn't pulled to the top-level like it is with npm.