Repository navigation
--install-strategy=nested still hoists workspace packages #6537
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
Currently, running npm install at the root of a monorepo using npm workspaces with the '--install-strategy=nested' flag almost does what I would expect it to do - it puts all the dependencies in separate node_modules folders for each package, but it still puts the symlinks to the local monorepo packages at the root.
Expected Behavior
I would expect the symlinks to the monorepo packages to be inserted into the nested node_modules folders rather than the root (and only for the packages that depend on them).
I also noticed that the --omit=dev flag seems to not work in this use case - note in the linked repro repo running 'npm install --install-strategy=nested --omit=dev' still results in eslint being added to workspace2's node_modules folder, even though it's only a devDependency. (I can make a separate issue for this if that would be better?)
Note for context: My use case here is a monorepo with multiple node apps in it, each of which needs to be separately bundled into a docker image with only it's dependencies, I don't want to unnecessarily include the dependencies of other packages in the monorepo. The '--install-strategy=nested' flag seems like what I need for my use case, but the current behaviour doesn't quite work.
Steps To Reproduce
- make sure you have npm 9.7.1
- clone this repo: https://github.com/pcone/npmissuerepro
- run 'npm install --install-strategy=nested --omit=dev' at the root
- note that a node_modules folder is still created at the root
- note that the nested node_modules folder for workspace1 does not contain a symlink to workspace2, despite it being a dependency
- note that eslint is still installed, despite being a dev dependency
Environment
- npm: 9.7.1
- Node.js: 16.16.0
- OS Name: Windows 10 22H2
- npm config:
; "user" config from C:\Users\<redacted>\.npmrc
<redacted internal repo>:_password = (protected)
<redacted internal repo>:email = "not-used@example.com"
<redacted internal repo>:username = <redacted>
; node bin location = C:\Program Files\nodejs\node.exe
; node version = v16.16.0
; npm local prefix = C:\S
; npm version = 9.7.1
; cwd = C:\S\npmrepro
; HOME = C:\Users\<redacted>
; Run `npm config ls -l` to show all defaults.
Activity
morganney commentedon Jun 24, 2023
I have experienced the same issue.
@pcone to get around the
--omit=devissue you need npm >= 9.7.2.Another repo for reproducing: https://github.com/morganney/npm-workspaces
If you run
npm install --install-strategy=nested --omit=dev --workspace=foothere will be transitive dependencies forfoo's dependencies inside of the root node_modules folder.I have created a workaround for this shortcoming by running
npm run build:foowhich effectively moves deps around from the associated node_modules directories.rmclaughlin-nelnet commentedon Aug 14, 2023
I have also experienced this. I have also seen shared dependencies still being hoisted. node-fetch seems to be affected. We have a several dependencies that depend on it and no matter what
npm install --install-strategy=nestedinstalls it in the root, not the sub packages.npm install --install-strategy=linkedseems to work better, but it is not optimal.It would be great to see a fix for this.
iamyobi commentedon Dec 21, 2023
I have the same issue.
npm 9.8.1
node 18.18.2
I removed node_modules
and ran install command with
install-strategy=nestedoption in package root, It doesn't help.requiel20 commentedon Feb 6, 2024
Also affected by this
r3ps4J commentedon Apr 30, 2024
Same issue here, npm 10.5.2 on node v20.11.1. I can't used linked either because it breaks the angular compiler.
benqus commentedon May 15, 2024
--install-strategy=nesteddoes not work innpm@10.5.2- I suggest this option to be taken out from the docs or at least mark it as such as it's misleadingDisable hoisting pnpm
fix: build scripts
mystiker commentedon Oct 11, 2024
You can still use
install-strategy=nested:All you have to do is
npm config set install-strategy="nested"to set this flag globally or.npmrcfile that contains: install-strategy = "nested"It looks like cli parameters are not passed/parsed correctly.
Environment variables are also possible according to The Docs but I didn't test that.
I used npm@10.5.0
hannupekka commentedon Oct 11, 2024
Does not work with npm@10.8.1. Dependencies are still hoisted to
<root>/node_modulesinstead of<root>/package/node_modulesQuentinLemCode commentedon Oct 14, 2024
I have the same issue
Even with
install-strategy = "nested"in .npmrcAnd usgin
npm i --install-strategy=nested -w packages/frontendAll dependencies are installed in the root
node_modules.The local
node_modulesonly contains dependencies with conflicting version. However this doesn't work because one of my dependency is checking typescript version, and it use the typescript lib from the rootnode_modulesinstead of the local one.tanepiper commentedon Nov 25, 2024
Can confirm the same here:
npm i --install-strategy=nested -w services/gatewayFrom this list of dependencies when I try to use buildpack, the ones that are missing are in
<root>/node_moduleswhile the ones found are in the correct workspace folder.tanepiper commentedon Nov 25, 2024
Possible workaround @pcone @hannupekka @QuentinLemCode - use
npm ciinsteadnpm ci --install-strategy=nested -w packages/frontendThis seems to work
hannupekka commentedon Nov 26, 2024
Nope, atleast on my machine
npm cistill hoists dependencies :(tanepiper commentedon Nov 26, 2024
Odd - using buildpack, it worked well after this. The only other difference it I put
install-strategy = "nested"in .npmrc in the root, and in the workspace folder of the monorepo, e.g.After this, it's working well for me.
mantoni commentedon Jan 9, 2025
What makes it work for me is
mkdir node_modules.ekymonthio commentedon May 2, 2025
Still affected by this using
npm@10.8.2None of the following works:
mkdir node_modules--workspace=false.npmrcwithinstall-strategy = "nested"in workspace root or packageAny hints?
bre30kra69cs commentedon Aug 1, 2025
npm@10.9.2By some reason this work for me. Remove
lockandnode_modulesbeforenpm i --install-strategy=nested --legacy-peer-deps--install-strategy=shallow- betterfeat!: remove @lerna/legacy-package-management after 2 years of depre…
rmclaughlin-nelnet commentedon Sep 24, 2025
Still not working for me on npm 10.9.2
andyjv commentedon Jan 6, 2026
The issue is that the
install-strategyactually impacts howpackage-lock.jsonis initially generated; however it will not automatically re-generatepackage-lock.jsonif you install using a different strategy than what was used to generate the lock.If you delete
package-lock.json, and re-generate usingnpm install --install-strategy=nested, the lock file will be generated "correctly", and the dependencies will be installed as described by the configuration. After that, all instances ofnpm installwill default to using the nested strategy until the lock file is deleted and re-generated.