npm install --from-lockfile

[nmm-shumway]

Based on the discussion on npm/cli#564 and a few other issues, it would be good to have an option to install based on the lockfile that is not a clean install. Currently npm install will change the lockfile and upgrade packages based on the the current contents of package.json.

• The --from-lockfile flag would apply to npm install and npm i.
• It would throw an error if the user attempted to add a new package with it (since that doesn't really make sense).
• It would throw an error if the user did not have a lockfile.

I have an example implementation that seems to be working locally, although there's still testing/cleanup that would need to be done and I still need to take some time to verify. I'm posting here to see if there's any reason why I shouldn't eventually make a pull request for this, or if there are any obvious concerns about the feature itself that I'm missing.

This specific implementation is loosely based off of @jdussouillez's comment and @DanielRuf's comment that both encouraged adding a new flags to npm install instead of npm ci.

It does not go all the way and add a --clean option to npm install, nor does it try to alias npm ci to npm install --from-lockfile --clean. I think those are reasonable solutions, but I'm just trying to make the smallest change possible that will make all of the desired behaviors possible without messing with npm ci at all.

Install times are going to vary depending on the system and package, but anecdotally I'm seeing a roughly 4x speedup between npm install --from-lockfile and npm ci on my system, so this may be a large performance improvement for some projects/setups.

[bbva-fer]

Thank you SO much for this.

I'd like to comment one detail, it may not be that important. If it throws an error when used with packages arguments, it could be problematic to use it in an .npmc file. We'd love to consider having all devs experience this behavior by default when using npm install, But still allow it to install packages (the flag could then be ignored).

This would mean adding this flag to the .npmrc would be transparent in a way for common uses of npm install, but would still add consistency to what code people are running later for the most common of the scenarios: running npm i.

In any case, I think this would be great!

[danShumway]

Agreed, I hadn't thought about it, but being able to specify behavior in .npmrc is very useful.

Current behavior is that the flag will throw an error if no package-lock.json (or other shrinkwrap) exists, but otherwise will just be ignored when installing new packages, making this safe to include in .npmrc.

[MylesBorins]

Hey @nmm-shumway thanks for opening the discussion.

If you would like to propose a specific new feature to the npm CLI the best next step is to open an issue over at https://github.com/npm/rfcs so you can gather feedback directly from the CLI team.

Adding new flags that don't change the existing behavior seems like the easiest way to move forward something like this.

[unre4l]

Any news about this feature? I havnt found a rfc pr, @nmm-shumway did you open one? Looking forward to this 🙂

[danShumway]

Deep apologies for the delay, things got a little hectic in my life shortly after I made this feature. I have a feature request at npm/rfcs#415, and I've moved the implementation over to danShumway/cli@bc8ef21. I'll be adding additional unit tests and some documentation depending on what the RFC requires.