Use Installer when packaging git dependencies by feelepxyz · Pull Request #189 · npm/cli

feelepxyz · 2019-04-16T11:14:45Z

When installing git dependencies, the config options: dry-run and ignore-scripts are being lost if set as cli arguments causing the prepare script to always run. We found this issue while doing an install that only needs to get lockfile changes. You can work around this by setting these settings in a .npmrc file.

We've also found an issue with proxying npm config to the cli when a large cafile has been set. The contents of cafile is expanded into the ca config key which get passed as a cli argument to install. When this file is big (e.g. including a custom cert + all system certs) it causes a kernel exception on Linux (E2BIG: Argument list too long).

The current implementation requires prepublish to be fully deprecated because I couldn't figure out a way to only set the ignore-prepublish config setting for the git install. Setting it with npm.config.set('ignore-prepublish', true) before the install doesn't seem to be picked up in the npm-lifecycle package when running the prepublish stage.

I imagine it will be a pain to deprecated prepublish without breaking a bunch of packages, is this still something you're planning or should I find a workaround?

This fixes a couple of config issues we've found when installing packages in `dry-run` mode to only get the lockfile changes. When setting `dry-run` or `ignore-scripts`, the setting isn't passed through when installing git dependencies meaning the `prepare` script is always run. We've also found an issue with proxying existing npm config to the cli when a large `cafile` has been set, as this is expanded into the `ca` config key with the full string contents of the ca file. If the ca file is huge this will blow up on linux with an E2BIG exception (Argument list too long). Increasing the limit requires kernel recompilation so isn't really an option. The current implementation requires `prepublish` to be fully deprecated, is this something you are planning? Otherwise I'm happy to find another way of passing this config through the installer.

isaacs · 2019-08-12T16:33:31Z

Fully deprecating prepublish is planned for npm v7, but we can't do that without a semver major bump. If you need help making this suitable for a patch/minor release, let me know. Sorry for the inconvenience.

feelepxyz · 2019-08-12T16:43:26Z

@isaacs great news! Can definitely wait for v7, we've worked around it on Dependabot so don't have an urgent need.

ljharb · 2019-08-12T17:30:30Z

What’s the point of fully deprecating it, as opposed to just making it be the same as prepublishOnly?

feelepxyz · 2020-07-17T10:22:28Z

Fully deprecating prepublish is planned for npm v7, but we can't do that without a semver major bump. If you need help making this suitable for a patch/minor release, let me know. Sorry for the inconvenience.

@isaacs what's the status on deprecating prepublish? Does this PR make sense in v7?

darcyclarke · 2020-07-31T18:44:20Z

Hey @feelepxyz! Sorry for the delay, we're going to close this PR as we've completely refactored this code in v7. Appreciate the contribution though.

feelepxyz · 2019-04-16T11:14:45Z

When installing git dependencies, the config options: dry-run and ignore-scripts are being lost if set as cli arguments causing the prepare script to always run. We found this issue while doing an install that only needs to get lockfile changes. You can work around this by setting these settings in a .npmrc file.

We've also found an issue with proxying npm config to the cli when a large cafile has been set. The contents of cafile is expanded into the ca config key which get passed as a cli argument to install. When this file is big (e.g. including a custom cert + all system certs) it causes a kernel exception on Linux (E2BIG: Argument list too long).

The current implementation requires prepublish to be fully deprecated because I couldn't figure out a way to only set the ignore-prepublish config setting for the git install. Setting it with npm.config.set('ignore-prepublish', true) before the install doesn't seem to be picked up in the npm-lifecycle package when running the prepublish stage.

I imagine it will be a pain to deprecated prepublish without breaking a bunch of packages, is this still something you're planning or should I find a workaround?

This fixes a couple of config issues we've found when installing packages in `dry-run` mode to only get the lockfile changes. When setting `dry-run` or `ignore-scripts`, the setting isn't passed through when installing git dependencies meaning the `prepare` script is always run. We've also found an issue with proxying existing npm config to the cli when a large `cafile` has been set, as this is expanded into the `ca` config key with the full string contents of the ca file. If the ca file is huge this will blow up on linux with an E2BIG exception (Argument list too long). Increasing the limit requires kernel recompilation so isn't really an option. The current implementation requires `prepublish` to be fully deprecated, is this something you are planning? Otherwise I'm happy to find another way of passing this config through the installer.

isaacs · 2019-08-12T16:33:31Z

Fully deprecating prepublish is planned for npm v7, but we can't do that without a semver major bump. If you need help making this suitable for a patch/minor release, let me know. Sorry for the inconvenience.

feelepxyz · 2019-08-12T16:43:26Z

@isaacs great news! Can definitely wait for v7, we've worked around it on Dependabot so don't have an urgent need.

ljharb · 2019-08-12T17:30:30Z

What’s the point of fully deprecating it, as opposed to just making it be the same as prepublishOnly?

feelepxyz · 2020-07-17T10:22:28Z

Fully deprecating prepublish is planned for npm v7, but we can't do that without a semver major bump. If you need help making this suitable for a patch/minor release, let me know. Sorry for the inconvenience.

@isaacs what's the status on deprecating prepublish? Does this PR make sense in v7?

darcyclarke · 2020-07-31T18:44:20Z

Hey @feelepxyz! Sorry for the delay, we're going to close this PR as we've completely refactored this code in v7. Appreciate the contribution though.

feelepxyz · 2019-04-16T11:14:45Z

When installing git dependencies, the config options: dry-run and ignore-scripts are being lost if set as cli arguments causing the prepare script to always run. We found this issue while doing an install that only needs to get lockfile changes. You can work around this by setting these settings in a .npmrc file.

We've also found an issue with proxying npm config to the cli when a large cafile has been set. The contents of cafile is expanded into the ca config key which get passed as a cli argument to install. When this file is big (e.g. including a custom cert + all system certs) it causes a kernel exception on Linux (E2BIG: Argument list too long).

The current implementation requires prepublish to be fully deprecated because I couldn't figure out a way to only set the ignore-prepublish config setting for the git install. Setting it with npm.config.set('ignore-prepublish', true) before the install doesn't seem to be picked up in the npm-lifecycle package when running the prepublish stage.

I imagine it will be a pain to deprecated prepublish without breaking a bunch of packages, is this still something you're planning or should I find a workaround?

This fixes a couple of config issues we've found when installing packages in `dry-run` mode to only get the lockfile changes. When setting `dry-run` or `ignore-scripts`, the setting isn't passed through when installing git dependencies meaning the `prepare` script is always run. We've also found an issue with proxying existing npm config to the cli when a large `cafile` has been set, as this is expanded into the `ca` config key with the full string contents of the ca file. If the ca file is huge this will blow up on linux with an E2BIG exception (Argument list too long). Increasing the limit requires kernel recompilation so isn't really an option. The current implementation requires `prepublish` to be fully deprecated, is this something you are planning? Otherwise I'm happy to find another way of passing this config through the installer.

isaacs · 2019-08-12T16:33:31Z

Fully deprecating prepublish is planned for npm v7, but we can't do that without a semver major bump. If you need help making this suitable for a patch/minor release, let me know. Sorry for the inconvenience.

feelepxyz · 2019-08-12T16:43:26Z

@isaacs great news! Can definitely wait for v7, we've worked around it on Dependabot so don't have an urgent need.

ljharb · 2019-08-12T17:30:30Z

What’s the point of fully deprecating it, as opposed to just making it be the same as prepublishOnly?

feelepxyz · 2020-07-17T10:22:28Z

Fully deprecating prepublish is planned for npm v7, but we can't do that without a semver major bump. If you need help making this suitable for a patch/minor release, let me know. Sorry for the inconvenience.

@isaacs what's the status on deprecating prepublish? Does this PR make sense in v7?

darcyclarke · 2020-07-31T18:44:20Z

Hey @feelepxyz! Sorry for the delay, we're going to close this PR as we've completely refactored this code in v7. Appreciate the contribution though.

feelepxyz · 2019-04-16T11:14:45Z

When installing git dependencies, the config options: dry-run and ignore-scripts are being lost if set as cli arguments causing the prepare script to always run. We found this issue while doing an install that only needs to get lockfile changes. You can work around this by setting these settings in a .npmrc file.

We've also found an issue with proxying npm config to the cli when a large cafile has been set. The contents of cafile is expanded into the ca config key which get passed as a cli argument to install. When this file is big (e.g. including a custom cert + all system certs) it causes a kernel exception on Linux (E2BIG: Argument list too long).

The current implementation requires prepublish to be fully deprecated because I couldn't figure out a way to only set the ignore-prepublish config setting for the git install. Setting it with npm.config.set('ignore-prepublish', true) before the install doesn't seem to be picked up in the npm-lifecycle package when running the prepublish stage.

I imagine it will be a pain to deprecated prepublish without breaking a bunch of packages, is this still something you're planning or should I find a workaround?

This fixes a couple of config issues we've found when installing packages in `dry-run` mode to only get the lockfile changes. When setting `dry-run` or `ignore-scripts`, the setting isn't passed through when installing git dependencies meaning the `prepare` script is always run. We've also found an issue with proxying existing npm config to the cli when a large `cafile` has been set, as this is expanded into the `ca` config key with the full string contents of the ca file. If the ca file is huge this will blow up on linux with an E2BIG exception (Argument list too long). Increasing the limit requires kernel recompilation so isn't really an option. The current implementation requires `prepublish` to be fully deprecated, is this something you are planning? Otherwise I'm happy to find another way of passing this config through the installer.

isaacs · 2019-08-12T16:33:31Z

Fully deprecating prepublish is planned for npm v7, but we can't do that without a semver major bump. If you need help making this suitable for a patch/minor release, let me know. Sorry for the inconvenience.

feelepxyz · 2019-08-12T16:43:26Z

@isaacs great news! Can definitely wait for v7, we've worked around it on Dependabot so don't have an urgent need.

ljharb · 2019-08-12T17:30:30Z

What’s the point of fully deprecating it, as opposed to just making it be the same as prepublishOnly?

feelepxyz · 2020-07-17T10:22:28Z

Fully deprecating prepublish is planned for npm v7, but we can't do that without a semver major bump. If you need help making this suitable for a patch/minor release, let me know. Sorry for the inconvenience.

@isaacs what's the status on deprecating prepublish? Does this PR make sense in v7?

darcyclarke · 2020-07-31T18:44:20Z

Hey @feelepxyz! Sorry for the delay, we're going to close this PR as we've completely refactored this code in v7. Appreciate the contribution though.

feelepxyz · 2019-04-16T11:14:45Z

When installing git dependencies, the config options: dry-run and ignore-scripts are being lost if set as cli arguments causing the prepare script to always run. We found this issue while doing an install that only needs to get lockfile changes. You can work around this by setting these settings in a .npmrc file.

We've also found an issue with proxying npm config to the cli when a large cafile has been set. The contents of cafile is expanded into the ca config key which get passed as a cli argument to install. When this file is big (e.g. including a custom cert + all system certs) it causes a kernel exception on Linux (E2BIG: Argument list too long).

The current implementation requires prepublish to be fully deprecated because I couldn't figure out a way to only set the ignore-prepublish config setting for the git install. Setting it with npm.config.set('ignore-prepublish', true) before the install doesn't seem to be picked up in the npm-lifecycle package when running the prepublish stage.

I imagine it will be a pain to deprecated prepublish without breaking a bunch of packages, is this still something you're planning or should I find a workaround?

This fixes a couple of config issues we've found when installing packages in `dry-run` mode to only get the lockfile changes. When setting `dry-run` or `ignore-scripts`, the setting isn't passed through when installing git dependencies meaning the `prepare` script is always run. We've also found an issue with proxying existing npm config to the cli when a large `cafile` has been set, as this is expanded into the `ca` config key with the full string contents of the ca file. If the ca file is huge this will blow up on linux with an E2BIG exception (Argument list too long). Increasing the limit requires kernel recompilation so isn't really an option. The current implementation requires `prepublish` to be fully deprecated, is this something you are planning? Otherwise I'm happy to find another way of passing this config through the installer.

isaacs · 2019-08-12T16:33:31Z

Fully deprecating prepublish is planned for npm v7, but we can't do that without a semver major bump. If you need help making this suitable for a patch/minor release, let me know. Sorry for the inconvenience.

feelepxyz · 2019-08-12T16:43:26Z

@isaacs great news! Can definitely wait for v7, we've worked around it on Dependabot so don't have an urgent need.

ljharb · 2019-08-12T17:30:30Z

What’s the point of fully deprecating it, as opposed to just making it be the same as prepublishOnly?

feelepxyz · 2020-07-17T10:22:28Z

Fully deprecating prepublish is planned for npm v7, but we can't do that without a semver major bump. If you need help making this suitable for a patch/minor release, let me know. Sorry for the inconvenience.

@isaacs what's the status on deprecating prepublish? Does this PR make sense in v7?

darcyclarke · 2020-07-31T18:44:20Z

Hey @feelepxyz! Sorry for the delay, we're going to close this PR as we've completely refactored this code in v7. Appreciate the contribution though.

feelepxyz · 2019-04-16T11:14:45Z

When installing git dependencies, the config options: dry-run and ignore-scripts are being lost if set as cli arguments causing the prepare script to always run. We found this issue while doing an install that only needs to get lockfile changes. You can work around this by setting these settings in a .npmrc file.

We've also found an issue with proxying npm config to the cli when a large cafile has been set. The contents of cafile is expanded into the ca config key which get passed as a cli argument to install. When this file is big (e.g. including a custom cert + all system certs) it causes a kernel exception on Linux (E2BIG: Argument list too long).

The current implementation requires prepublish to be fully deprecated because I couldn't figure out a way to only set the ignore-prepublish config setting for the git install. Setting it with npm.config.set('ignore-prepublish', true) before the install doesn't seem to be picked up in the npm-lifecycle package when running the prepublish stage.

I imagine it will be a pain to deprecated prepublish without breaking a bunch of packages, is this still something you're planning or should I find a workaround?

This fixes a couple of config issues we've found when installing packages in `dry-run` mode to only get the lockfile changes. When setting `dry-run` or `ignore-scripts`, the setting isn't passed through when installing git dependencies meaning the `prepare` script is always run. We've also found an issue with proxying existing npm config to the cli when a large `cafile` has been set, as this is expanded into the `ca` config key with the full string contents of the ca file. If the ca file is huge this will blow up on linux with an E2BIG exception (Argument list too long). Increasing the limit requires kernel recompilation so isn't really an option. The current implementation requires `prepublish` to be fully deprecated, is this something you are planning? Otherwise I'm happy to find another way of passing this config through the installer.

isaacs · 2019-08-12T16:33:31Z

Fully deprecating prepublish is planned for npm v7, but we can't do that without a semver major bump. If you need help making this suitable for a patch/minor release, let me know. Sorry for the inconvenience.

feelepxyz · 2019-08-12T16:43:26Z

@isaacs great news! Can definitely wait for v7, we've worked around it on Dependabot so don't have an urgent need.

ljharb · 2019-08-12T17:30:30Z

What’s the point of fully deprecating it, as opposed to just making it be the same as prepublishOnly?

feelepxyz · 2020-07-17T10:22:28Z

Fully deprecating prepublish is planned for npm v7, but we can't do that without a semver major bump. If you need help making this suitable for a patch/minor release, let me know. Sorry for the inconvenience.

@isaacs what's the status on deprecating prepublish? Does this PR make sense in v7?

darcyclarke · 2020-07-31T18:44:20Z

Hey @feelepxyz! Sorry for the delay, we're going to close this PR as we've completely refactored this code in v7. Appreciate the contribution though.

feelepxyz · 2019-04-16T11:14:45Z

When installing git dependencies, the config options: dry-run and ignore-scripts are being lost if set as cli arguments causing the prepare script to always run. We found this issue while doing an install that only needs to get lockfile changes. You can work around this by setting these settings in a .npmrc file.

We've also found an issue with proxying npm config to the cli when a large cafile has been set. The contents of cafile is expanded into the ca config key which get passed as a cli argument to install. When this file is big (e.g. including a custom cert + all system certs) it causes a kernel exception on Linux (E2BIG: Argument list too long).

The current implementation requires prepublish to be fully deprecated because I couldn't figure out a way to only set the ignore-prepublish config setting for the git install. Setting it with npm.config.set('ignore-prepublish', true) before the install doesn't seem to be picked up in the npm-lifecycle package when running the prepublish stage.

I imagine it will be a pain to deprecated prepublish without breaking a bunch of packages, is this still something you're planning or should I find a workaround?

This fixes a couple of config issues we've found when installing packages in `dry-run` mode to only get the lockfile changes. When setting `dry-run` or `ignore-scripts`, the setting isn't passed through when installing git dependencies meaning the `prepare` script is always run. We've also found an issue with proxying existing npm config to the cli when a large `cafile` has been set, as this is expanded into the `ca` config key with the full string contents of the ca file. If the ca file is huge this will blow up on linux with an E2BIG exception (Argument list too long). Increasing the limit requires kernel recompilation so isn't really an option. The current implementation requires `prepublish` to be fully deprecated, is this something you are planning? Otherwise I'm happy to find another way of passing this config through the installer.

isaacs · 2019-08-12T16:33:31Z

Fully deprecating prepublish is planned for npm v7, but we can't do that without a semver major bump. If you need help making this suitable for a patch/minor release, let me know. Sorry for the inconvenience.

feelepxyz · 2019-08-12T16:43:26Z

@isaacs great news! Can definitely wait for v7, we've worked around it on Dependabot so don't have an urgent need.

ljharb · 2019-08-12T17:30:30Z

What’s the point of fully deprecating it, as opposed to just making it be the same as prepublishOnly?

feelepxyz · 2020-07-17T10:22:28Z

Fully deprecating prepublish is planned for npm v7, but we can't do that without a semver major bump. If you need help making this suitable for a patch/minor release, let me know. Sorry for the inconvenience.

@isaacs what's the status on deprecating prepublish? Does this PR make sense in v7?

darcyclarke · 2020-07-31T18:44:20Z

Hey @feelepxyz! Sorry for the delay, we're going to close this PR as we've completely refactored this code in v7. Appreciate the contribution though.

feelepxyz · 2019-04-16T11:14:45Z

When installing git dependencies, the config options: dry-run and ignore-scripts are being lost if set as cli arguments causing the prepare script to always run. We found this issue while doing an install that only needs to get lockfile changes. You can work around this by setting these settings in a .npmrc file.

We've also found an issue with proxying npm config to the cli when a large cafile has been set. The contents of cafile is expanded into the ca config key which get passed as a cli argument to install. When this file is big (e.g. including a custom cert + all system certs) it causes a kernel exception on Linux (E2BIG: Argument list too long).

The current implementation requires prepublish to be fully deprecated because I couldn't figure out a way to only set the ignore-prepublish config setting for the git install. Setting it with npm.config.set('ignore-prepublish', true) before the install doesn't seem to be picked up in the npm-lifecycle package when running the prepublish stage.

I imagine it will be a pain to deprecated prepublish without breaking a bunch of packages, is this still something you're planning or should I find a workaround?

This fixes a couple of config issues we've found when installing packages in `dry-run` mode to only get the lockfile changes. When setting `dry-run` or `ignore-scripts`, the setting isn't passed through when installing git dependencies meaning the `prepare` script is always run. We've also found an issue with proxying existing npm config to the cli when a large `cafile` has been set, as this is expanded into the `ca` config key with the full string contents of the ca file. If the ca file is huge this will blow up on linux with an E2BIG exception (Argument list too long). Increasing the limit requires kernel recompilation so isn't really an option. The current implementation requires `prepublish` to be fully deprecated, is this something you are planning? Otherwise I'm happy to find another way of passing this config through the installer.

isaacs · 2019-08-12T16:33:31Z

Fully deprecating prepublish is planned for npm v7, but we can't do that without a semver major bump. If you need help making this suitable for a patch/minor release, let me know. Sorry for the inconvenience.

feelepxyz · 2019-08-12T16:43:26Z

@isaacs great news! Can definitely wait for v7, we've worked around it on Dependabot so don't have an urgent need.

ljharb · 2019-08-12T17:30:30Z

What’s the point of fully deprecating it, as opposed to just making it be the same as prepublishOnly?

feelepxyz · 2020-07-17T10:22:28Z

Fully deprecating prepublish is planned for npm v7, but we can't do that without a semver major bump. If you need help making this suitable for a patch/minor release, let me know. Sorry for the inconvenience.

@isaacs what's the status on deprecating prepublish? Does this PR make sense in v7?

darcyclarke · 2020-07-31T18:44:20Z

Hey @feelepxyz! Sorry for the delay, we're going to close this PR as we've completely refactored this code in v7. Appreciate the contribution though.

feelepxyz requested a review from a team as a code owner April 16, 2019 11:14

isaacs added needs-discussion semver:patch semver patch level for changes labels Jun 26, 2019

settingsBot removed the needs-discussion label Nov 5, 2019

ruyadorno added Needs Discussion is pending a discussion Release 7.x work is associated with a specific npm 7 release labels Jan 7, 2020

darcyclarke closed this Jul 31, 2020

MrBrain295 mentioned this pull request May 20, 2024
[Snyk] Security upgrade read-package-json from 3.0.1 to 7.0.1 MrBrain295/cli#15
Open

mtdev2 mentioned this pull request May 20, 2024
[Snyk] Fix for 9 vulnerabilities mtdev2/cli#96
Open

baby636 mentioned this pull request May 21, 2024
[Snyk] Fix for 15 vulnerabilities baby636/cli#81
Open

bumplzz69 mentioned this pull request May 21, 2024
[Snyk] Fix for 10 vulnerabilities bumplzz69/cli#44
Open

Bhanditz mentioned this pull request May 21, 2024
[Snyk] Fix for 10 vulnerabilities Bhanditz/cli#35
Open

snyk-ioBot mentioned this pull request Oct 22, 2024
[Snyk] Fix for 55 vulnerabilities Graybar-codespace/cli-3#116
Open

github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Jul 6, 2026
🤖 봇 응답 (npm#189)
b223833

github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Jul 16, 2026
📊 blog1 게시 완료 (npm#189)
5c6060a

github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Jul 16, 2026
📊 blog2 게시 완료 (npm#189)
c5bff93

github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Jul 16, 2026
📊 blog3 게시 완료 (npm#189)
33ee69a

github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Aug 3, 2026
🔧 자동 수리 완료 (npm#189)
0f652f9

github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Aug 17, 2026
🔥 트렌드 선점 후보 갱신 (npm#189)
4282983