Repository navigation
[BUG] npm ls --all does not list dependency tree without node_modules #3068
Description
Current Behavior:
The command npm ls --all does not list the dependency tree, without node_modules folder. This command is failing to list the dependency tree with only the package-lock.json file, using npm v7.
Expected Behavior:
Using npm v6, the npm ls command is working as expected, by listing the dependency tree, with only the package.json and package-lock.json files present, and without node_modules folder.
Steps To Reproduce:
- In a project folder with package.json and with package-lock.json files, and without node_modules folder
- Run
npm ls --all --json
or
- In a project folder with package.json
- Run
npm install - Delete de node_modules folder
- Run
npm ls --all --json
Environment:
- OS: Windows 10
- Node: 14.15.1
- npm: 7.9.0
or
- OS: Debian 10
- Node: 12.13.0
- npm: 7.9.0
Reacted by AA
Activity
nlf commentedon Apr 13, 2021
confirmed, easy to reproduce this one. thanks for letting us know!
isaacs commentedon Jun 11, 2021
Umm.... I'm pretty sure npm@6 used the actual tree as well?
The output is almost identical between v6 and v7. There is a problem that we print two JSON blobs when there's errors in v7, though, that's a bug.
G-Rath commentedon Jun 11, 2021
Pulling my comment over from my PR, since this is the better place to discuss:
@isaacs I've got need to have
npm listbehaviour on the virtual tree foraudit-appto backfill information on dependency paths & versions because the new auditing output doesn't have all the information we need for that - using the virtual tree means you don't have to actually be able to successfully install saving a lot of time and pain when using tooling to do mass project auditing.Additionally, there is the sort-of bug/inconsistency with the output of
npm auditvsnpm listthat I mentioned in my PR (I tried to make a simple reproduction, but it proved too hard to pin down to just a few dependencies since npm would keep trying to pull in patched versions ofini) that this would help explain.Would implementing a new flag (i.e
--virtual) be on the table? I'd expect from what I was when exploring this issue originally, it shouldn't be too hard to implement (just a matter of having the flag and then changing the line from my PR to beif: loadVirtual; else: loadActual.milaninfy commentedon Jun 5, 2025
For some reason this was not closed but it looks like it's fixed by #3408.
npm-ls#package-lock-only