fix: clear exclusive param siblings when setting from CLI#9023
Open
umeshmore45 wants to merge 3 commits intonpm:latestfrom
Open
fix: clear exclusive param siblings when setting from CLI#9023umeshmore45 wants to merge 3 commits intonpm:latestfrom
umeshmore45 wants to merge 3 commits intonpm:latestfrom
Conversation
When an exclusive config parameter is set via CLI, now clear its sibling parameters in the environment to prevent child processes from seeing conflicting values. Adds test coverage for the scenario where save-prod is set via CLI while save-dev exists in env.
Cleaned up the test environment configuration by removing unnecessary environment variables from the file. This simplifies the test setup and improves clarity.
…deprecated siblings Introduced new test cases to verify that exclusive parameters do not clear their siblings when is set to false or when they are marked as deprecated. This ensures correct behavior in the configuration management for CLI and environment variables.
Contributor
|
Thanks for working on this @umeshmore45 — the approach of fixing it generically in set-envs.js for all exclusive params is the right direction per @wraithgar's feedback. However, the bug is still reproducible with this PR applied. The core issue is what the child process sees when pacote prepares a git dep, which you can test directly: npm_config_min_release_age=2 node bin/npm-cli.js install --before=2026-02-23T00:00:00.000Z --dry-run
# => --min-release-age cannot be provided when using --beforeThis fails identically with and without the PR. The fix resets npm_config_before="" in the parent's env, but the child's loadEnv skips empty strings, so it has no effect. The actual conflict is between npm_config_min_release_age (still in env) and --before (CLI arg added by pacote) — the fix clears the sibling, but the original config causing the conflict is untouched. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix: clear exclusive sibling configs from env when one is set via CLI
What's the problem?
If you set an exclusive param via CLI (e.g.
--save-prod) but a sibling(
npm_config_save_dev=true) is already in the environment, child processesinherit both and crash with a conflict. This was also the root cause of the
--min-release-age+--beforeissue in #9005.What changed
When
setEnvsexports a non-default exclusive config, it now resets thatparam's siblings to their defaults in the env — so child processes never
see a conflict. Works generically for all exclusive pairs, not just this one.
Tests
Added a test for the case where
save-prodis set via CLI whilesave-devis already in env — verifies
save-devgets reset to its default.References
Fixes #9005