<h3 dir="auto">Is there an existing issue for this?</h3>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I have searched the existing issues</li>
</ul>
<h3 dir="auto">This issue exists in the latest npm version</h3>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I am using the latest npm</li>
</ul>
<h3 dir="auto">Current Behavior</h3>
<p dir="auto">When an existing shrinkwrap is installed</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="npm init
npm i @polymer/polymer@3.2.0 @vaadin/vaadin-core-shrinkwrap@23.0.0-beta1 --save"><pre class="notranslate"><code class="notranslate">npm init
npm i @polymer/polymer@3.2.0 @vaadin/vaadin-core-shrinkwrap@23.0.0-beta1 --save
</code></pre></div>
<p dir="auto">And you lock the version of a package not mentioned in the shrinkwrap</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="# Add &quot;overrides&quot;: { &quot;@polymer/polymer&quot;: &quot;$@polymer/polymer&quot;} to package.json"><pre class="notranslate"><code class="notranslate"># Add "overrides": { "@polymer/polymer": "$@polymer/polymer"} to package.json
</code></pre></div>
<p dir="auto">You can then no longer upgrade the shrinkwrap</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="npm i @vaadin/vaadin-core-shrinkwrap@23.0.0-beta2 "><pre class="notranslate"><code class="notranslate">npm i @vaadin/vaadin-core-shrinkwrap@23.0.0-beta2 
</code></pre></div>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="npm ERR! Unable to resolve reference $@polymer/polymer"><pre class="notranslate"><code class="notranslate">npm ERR! Unable to resolve reference $@polymer/polymer
</code></pre></div>
<h3 dir="auto">Expected Behavior</h3>
<p dir="auto">You can install the new shrinkwrap even if an unrelated package has an <code class="notranslate">override</code> defined.</p>
<h3 dir="auto">Steps To Reproduce</h3>
<ol dir="auto">
<li>git clone <a href="https://github.com/Artur-/npm-overrides-test.git">https://github.com/Artur-/npm-overrides-test.git</a></li>
<li>cd npm-overrides-test</li>
<li>npm i @vaadin/vaadin-core-shrinkwrap@23.0.0-beta2</li>
</ol>
<h3 dir="auto">Environment</h3>
<ul dir="auto">
<li>npm: 8.5.0</li>
<li>Node.js:v17.3.0</li>
<li>OS Name: Mac os Big Sur</li>
<li>System Model Name: Macbook Pro</li>
<li>npm config:</li>
</ul>
<div class="highlight highlight-source-ini notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="//registry.npmjs.org/:_authToken = (protected) "><pre class="notranslate">//registry.npmjs.org/:<span class="pl-k">_authToken</span> = (protected) </pre></div>
<h1 dir="auto">What / Why</h1>
<p dir="auto">Recently I've been running <code class="notranslate">npm init</code> on modules to ensure that <code class="notranslate">package.json</code> is well-formed and has all of the relevant data. I just noticed a fun bug where <code class="notranslate">npm init</code> copies your <code class="notranslate">optionalDependencies</code> to <code class="notranslate">dependencies</code>, which <a href="https://docs.npmjs.com/files/package.json#optionaldependencies" rel="nofollow">the documentation</a> discourages:</p>
<blockquote>
<p dir="auto">Entries in <strong><code class="notranslate">optionalDependencies</code></strong> will override entries of the same name in <strong><code class="notranslate">dependencies</code></strong>, so it’s usually best to only put in one place.</p>
</blockquote>
<h2 dir="auto">When</h2>
<p dir="auto">I run <code class="notranslate">npm init</code> on a module with optional dependencies.</p>
<h2 dir="auto">Where</h2>
<ul dir="auto">
<li>n/a</li>
</ul>
<h2 dir="auto">How</h2>
<h3 dir="auto">Current Behavior</h3>
<p dir="auto"><code class="notranslate">npm init</code> duplicates <code class="notranslate">optionalDependencies</code> to <code class="notranslate">dependencies</code></p>
<h3 dir="auto">Steps to Reproduce</h3>
<ul dir="auto">
<li><code class="notranslate">cd $(mktemp -d)</code></li>
<li><code class="notranslate">npm init -y</code></li>
<li><code class="notranslate">npm i --save-optional lodash</code></li>
<li><code class="notranslate">npm init -y</code></li>
</ul>
<p dir="auto">I've made a Git repository with the output tree of each command <a href="https://github.com/christianbundy/wtf-npm/commits/master">here</a>.</p>
<h3 dir="auto">Expected Behavior</h3>
<p dir="auto">npm should not duplicate <code class="notranslate">optionalDependencies</code> to <code class="notranslate">dependencies</code></p>
<h2 dir="auto">Who</h2>
<ul dir="auto">
<li>n/a</li>
</ul>
<h2 dir="auto">References</h2>
<ul dir="auto">
<li>n/a</li>
</ul>