<h3 dir="auto">Is there an existing issue for this?</h3>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I have searched the existing issues</li>
</ul>
<h3 dir="auto">Current Behavior</h3>
<p dir="auto">The <code class="notranslate">npm audit --production</code> command includes vulnerabilities of transitive devDependencies in its report. Using @thiagoelg/node-printer as an example, a vulnerability is reported for <code class="notranslate">diff</code> if @thiagoelg/node-printer is declared as a dependency. But <code class="notranslate">diff</code> is not installed by <code class="notranslate">npm install --production</code>, because it is a transitive dependency of nodeunit, which is a devDependency of @thiagoelg/node-printer.</p>
<h3 dir="auto">Expected Behavior</h3>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="found 0 vulnerabilities"><pre class="notranslate"><code class="notranslate">found 0 vulnerabilities
</code></pre></div>
<h3 dir="auto">Steps To Reproduce</h3>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="npm init -y
npm install --save @thiagoelg/node-printer@^0.5.5
npm audit --production"><pre class="notranslate"><code class="notranslate">npm init -y
npm install --save @thiagoelg/node-printer@^0.5.5
npm audit --production
</code></pre></div>
<h3 dir="auto">Output</h3>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="# npm audit report

diff  &lt;3.5.0
Severity: high
Regular Expression Denial of Service - https://npmjs.com/advisories/1631
fix available via `npm audit fix`
node_modules/@thiagoelg/node-printer/node_modules/diff
  tap-mocha-reporter  0.0.4 - 5.0.0
  Depends on vulnerable versions of diff
  node_modules/@thiagoelg/node-printer/node_modules/tap-mocha-reporter
    tap  7.0.0 - 14.6.7 || 14.10.2-totally-bundled - 14.10.2-unbundled
    Depends on vulnerable versions of tap-mocha-reporter
    node_modules/@thiagoelg/node-printer/node_modules/tap
      nodeunit  &gt;=0.9.3
      Depends on vulnerable versions of tap
      node_modules/@thiagoelg/node-printer/node_modules/nodeunit

hosted-git-info  &lt;2.8.9 || &gt;=3.0.0 &lt;3.0.8
Severity: moderate
Regular Expression Denial of Service - https://npmjs.com/advisories/1677
fix available via `npm audit fix`
node_modules/@thiagoelg/node-printer/node_modules/hosted-git-info

lodash  &lt;=4.17.20
Severity: high
Prototype Pollution - https://npmjs.com/advisories/1523
Command Injection - https://npmjs.com/advisories/1673
fix available via `npm audit fix`
node_modules/@thiagoelg/node-printer/node_modules/lodash

y18n  &lt;3.2.2||=4.0.0||&gt;=5.0.0 &lt;5.0.5
Severity: high
Prototype Pollution - https://npmjs.com/advisories/1654
fix available via `npm audit fix`
node_modules/@thiagoelg/node-printer/node_modules/y18n

7 vulnerabilities (1 moderate, 6 high)

To address all issues, run:
  npm audit fix"><pre class="notranslate"><code class="notranslate"># npm audit report

diff  &lt;3.5.0
Severity: high
Regular Expression Denial of Service - https://npmjs.com/advisories/1631
fix available via `npm audit fix`
node_modules/@thiagoelg/node-printer/node_modules/diff
  tap-mocha-reporter  0.0.4 - 5.0.0
  Depends on vulnerable versions of diff
  node_modules/@thiagoelg/node-printer/node_modules/tap-mocha-reporter
    tap  7.0.0 - 14.6.7 || 14.10.2-totally-bundled - 14.10.2-unbundled
    Depends on vulnerable versions of tap-mocha-reporter
    node_modules/@thiagoelg/node-printer/node_modules/tap
      nodeunit  &gt;=0.9.3
      Depends on vulnerable versions of tap
      node_modules/@thiagoelg/node-printer/node_modules/nodeunit

hosted-git-info  &lt;2.8.9 || &gt;=3.0.0 &lt;3.0.8
Severity: moderate
Regular Expression Denial of Service - https://npmjs.com/advisories/1677
fix available via `npm audit fix`
node_modules/@thiagoelg/node-printer/node_modules/hosted-git-info

lodash  &lt;=4.17.20
Severity: high
Prototype Pollution - https://npmjs.com/advisories/1523
Command Injection - https://npmjs.com/advisories/1673
fix available via `npm audit fix`
node_modules/@thiagoelg/node-printer/node_modules/lodash

y18n  &lt;3.2.2||=4.0.0||&gt;=5.0.0 &lt;5.0.5
Severity: high
Prototype Pollution - https://npmjs.com/advisories/1654
fix available via `npm audit fix`
node_modules/@thiagoelg/node-printer/node_modules/y18n

7 vulnerabilities (1 moderate, 6 high)

To address all issues, run:
  npm audit fix
</code></pre></div>
<h3 dir="auto">Environment</h3>
<ul dir="auto">
<li>OS: Ubuntu 18.04</li>
<li>Node: 14.17.2</li>
<li>npm: 7.19.1</li>
</ul>
<h3 dir="auto">Is there an existing issue for this?</h3>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I have searched the existing issues</li>
</ul>
<h3 dir="auto">This issue exists in the latest npm version</h3>
<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I am using the latest npm</li>
</ul>
<h3 dir="auto">Current Behavior</h3>
<p dir="auto">When installing a package (<code class="notranslate">npm install &lt;package name&gt;</code>) from the npm registry that contains an npm-shrinkwrap.json, dependencies listed with <code class="notranslate">"dev": true</code> are installed unexpectedly.</p>
<h3 dir="auto">Expected Behavior</h3>
<p dir="auto"><code class="notranslate">devDependencies</code> of the published package should not be installed when consuming the package.</p>
<h3 dir="auto">Steps To Reproduce</h3>
<p dir="auto">Given: Node.js v16.13.2 and npm v8.3.2</p>
<p dir="auto">I created an example project to showcase this issue: <a href="https://github.com/RandomByte/npm-shrinkwrap-test">https://github.com/RandomByte/npm-shrinkwrap-test</a></p>
<ol dir="auto">
<li><code class="notranslate">git clone git@github.com:RandomByte/npm-shrinkwrap-test.git &amp;&amp; cd npm-shrinkwrap-test</code></li>
<li><code class="notranslate">npm install</code></li>
<li>Check for known devDependency "ava" and notice that it has been installed:
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="npm ls -a | grep 'ava'
&gt; ├─┬ ava@3.15.0 extraneous"><pre class="notranslate"><code class="notranslate">npm ls -a | grep 'ava'
&gt; ├─┬ ava@3.15.0 extraneous
</code></pre></div>
</li>
<li><code class="notranslate">npm prune --production</code> removes the <code class="notranslate">ava</code> package. But a following <code class="notranslate">npm install</code> will install it again</li>
</ol>
<p dir="auto">It seems that after installing <code class="notranslate">@ui5/cli@next</code> in the empty project, its devDependencies where installed as normal dependencies. This is unexpected since a consumer of the package does not need its devDependencies.</p>
<p dir="auto">In the past (with npm v6) we worked around this issue by executing <code class="notranslate">npm prune --production</code> followed by <code class="notranslate">npm shrinkwrap</code> during publishing of the <code class="notranslate">@ui5/cli</code> package. This basically removed all devDependencies from the npm-shrinkwrap.json (see <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="746838250" data-permission-text="Title is private" data-url="https://github.com/SAP/ui5-tooling/issues/283" data-hovercard-type="issue" data-hovercard-url="/SAP/ui5-tooling/issues/283/hovercard?comment_id=599985109&amp;comment_type=issue_comment" href="https://github.com/SAP/ui5-tooling/issues/283#issuecomment-599985109">SAP/ui5-tooling#283 (comment)</a>). But this does not seem to work with npm v8 anymore, as the npm-shrinkwrap.json is not being updated after the prune took place.</p>
<p dir="auto">I think the fundamental issue is present since at least npm v6. Relevant issues are:</p>
<ul dir="auto">
<li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="584792212" data-permission-text="Title is private" data-url="https://github.com/npm/cli/issues/1036" data-hovercard-type="issue" data-hovercard-url="/npm/cli/issues/1036/hovercard" href="https://github.com/npm/cli/issues/1036">#1036</a></li>
<li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="711525813" data-permission-text="Title is private" data-url="https://github.com/npm/cli/issues/1878" data-hovercard-type="issue" data-hovercard-url="/npm/cli/issues/1878/hovercard" href="https://github.com/npm/cli/issues/1878">#1878</a></li>
<li><a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="594968571" data-permission-text="Title is private" data-url="https://github.com/npm/cli/issues/1113" data-hovercard-type="issue" data-hovercard-url="/npm/cli/issues/1113/hovercard" href="https://github.com/npm/cli/issues/1113">#1113</a>
<ul dir="auto">
<li>This issue has actually been fixed: In the project above <code class="notranslate">npm install --production</code> does not install the dependency's <code class="notranslate">devDependencies</code>. However, I would expect this exact behavior from <code class="notranslate">npm install</code> (without the <code class="notranslate">--production</code> flag) since I don't see a point in installing transitive <code class="notranslate">devDependencies</code></li>
</ul>
</li>
</ul>
<h3 dir="auto">Environment</h3>
<ul dir="auto">
<li>npm:  v8.3.2</li>
<li>Node.js: v16.13.2</li>
<li>OS Name: macOS 12.1 (Monterey)</li>
<li>System Model Name: MacBook Pro</li>
<li>npm config:</li>
</ul>
<div class="highlight highlight-source-ini notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="registry = &quot;https://registry.npmjs.com/&quot; "><pre class="notranslate"><span class="pl-k">registry</span> = <span class="pl-s"><span class="pl-pds">"</span>https://registry.npmjs.com/<span class="pl-pds">"</span></span> </pre></div>