Cross-platform package-lock.json

[jlarmstrongiv]

What version of Turborepo are you using?

1.2.16

What package manager are you using / does the bug impact?

npm

What operating system are you using?

Linux, MacOS

Describe the Bug

NPM has problems with lockfiles with platform-specific optional dependencies.

Simply put, npm install on macOS vs Linux generates different package.json files.

This issue affects a small subset of platform-specific optional packages, e.g. fsevents, @next/swc-<platform>, and turbo-<platform>.

I want turbo to automatically detect and patch my package-lock.json file, like @next/swc does. See:

• https://github.com/vercel/next.js/blob/c947abb43987347e3e75a28d20cace0eabc607e6/packages/next/lib/patch-incorrect-lockfile.ts

Unfortunately, this issue has plagued npm for a while:

• package-lock.json and optional packages npm/npm#17722
• [BUG] Platform-specific optional dependencies not being included in package-lock.json when reinstalling with node_modules present npm/cli#4828

Expected Behavior

npm ci --include=dev --include=optional --include=peer with turbo works regardless of which operating system npm install is run on.

To Reproduce

• On one platform, run npm install in a turbo monorepo to generate a package-lock.json file
• On another platform, run npm ci --include=dev --include=optional --include=peer in a turbo monorepo and try running npx turbo

The workaround is to run npm install on every platform you run your project, every time you regenerate the package-lock.json

[nathanhammond]

npm as an ecosystem does poorly with architecture/OS as it isn't a core part of the functionality. It has been an issue since forever. npm/npm#17722

That Turborepo is abusing npm and a post-install script to make sure you get the correct architecture is a hack.

I have two workarounds for you:

• Install turbo globally instead of as a project dependency. (This is in line with the direction we're heading.)
• Check out Yarn or pnpm.

As for patching, we could attempt to patch a lockfile from npm here: https://github.com/vercel/turborepo/blob/main/cli/npm/turbo-install/install.js

This is certainly possible, but it is not a high priority task for us at this time.

[flogy]

Had issues with using dev dependencies in my build scripts too. Could only solve them by migrating from npm to pnpm as suggested by @nathanhammond . Thanks for your help!

[jlarmstrongiv]

@flogy

You can also run npm install on both mac and linux—the key is keeping the same lockfile.

A non-recommended way would be to install the turbo dependencies specifically, e.g. turbo-linux-64

[jlarmstrongiv]

Related #1126

[amercier]

Related #3317

[nathanhammond]

Closing and locking this. If you encounter this after following steps in this and linked issues, please file a new issue!