[BUG] Removed modules left behind in package-lock.json if they were installed from a local folder

[Malvineous]

Current Behavior:

Running npm install ../localpkg && rpm remove localpkg results in entries for ../localpkg being left behind in package-lock.json even though the module has been completely removed.

Expected Behavior:

In NPM 6.x (and in 7.x for non-local packages), their entries are removed from package-lock.json when a package is removed. This behaviour should also apply to packages installed from a local folder.

Steps To Reproduce:

1. git stash (to start with a clean repo)
2. npm install ../some-package
3. npm remove ../some-package
4. git diff package-lock.json
5. Observe there are now new entries in package-lock.json for ../some-package even though it was removed.

My use case is that for local development, I am removing a module from my project and installing a local version of it for development, so that I can work on both my code and the module code concurrently. When I am ready to deploy, I then remove the local version and install the published version. However while this used to work fine with NPM 6.x, since upgrading to 7.x it now always leaves behind unwanted entries in package-lock.json for the version in the local folder I was using temporarily.

I am currently using either git or a text editor to remove these extra entries from package-lock.json. Running npm install does not put them back or complain, confirming that they are unnecessary, so it would be nice if npm took care of this automatically like it did in 6.x.

Environment:

• OS: Arch Linux
• Node: 15.14.0
• npm: 7.9.0 and 7.10.0

[ath0mas]

Same here.
(removing with npm remove some-package-name and not with its path, that does not remove it)

Comparing package-lock.json between basic project without local package / never installed, and same but with this local package first installed and then removed shows a single difference, that is this entry for "../some-package": {..} left behind inside "packages": {..} section.

Between install and remove we can see that all entries about the local package are removed, except "../some-package": {..} that is still here and changes a little: 2 new attributes are added = "name": "some-package-name" and "extraneous": true.

Environment:

• OS: Windows 10
• Node: 16.0.0
• npm: 7.10.0

[Shashank-Bhatt1]

I am also getting same issue after uninstalling my local package. I tried all command but none of them removes local package entry which left behind after doing npm uninstall ../some/package with extraneous: true. I am unsure whether it would cause any issue if i push lock file with that entry or should i manually remove?

It would be nice if npm doc share some video on how exactly to uninstall local package and then install live pakckage from npm registry

[Malvineous]

Which version of npm are you using? I haven't seen this problem for a while now. I'm running v10.8.3.

[Shashank-Bhatt1]

I changed to npm 10.8.2 with node 20.18.0 which is lts and still facing same issue, local package entry after uninstalling is never removed from package-lock.json and stays with "extraneous": true,

[Malvineous]

Just to confirm, did you start with a clean package-lock.json? The newer npm won't clean up the stuff left behind from earlier versions, but it no longer appears to leave anything behind of its own. So if you start with a clean file you'll finish with a clean file, but if your package-lock.json is dirty to begin with, it won't get cleaned.

[Shashank-Bhatt1]

I can't as my project already has it. Can I delete and generate a new without extraneous? Or should I simply delete node_modules and package-lock both followed by npm install?

[Malvineous]

Yes you can do that. You should find once you have a clean package-lock.json that installing and removing local packages no longer leaves anything behind.