Do not install developer dependencies for NodeJS

[mattyclarkson]

search tried in the issue tracker

dev node

describe your issue

The NodeJS language install command uses --dev (which should be --include=dev, #1983) to install packages. This is unneeded.

Packages only require the production (dependencies) installed. Any package that is requiring the developer dependencies to be installed to operate is broken.

If a package is using peerDependencies then additional_dependencies should be used to install them.

This is an issue when installing NPM modules when the developer dependencies are of significant size. The pre-commit users have to sit through a lengthy download session when warming up the pre-commit cache. The downloaded dependencies are unused once installed.

pre-commit --version

pre-commit 2.17.0

.pre-commit-config.yaml

# any config that installs NPM modules

~/.cache/pre-commit/pre-commit.log (if present)

No response

[asottile]

this was the command recommended by the npm developers

a common example is when a tool uses typescript

[mattyclarkson]

Ah, because we're installing directly from git and there are build steps, gottit.

Is there any interest in making that configurable as part of the install?

[asottile]

no it shouldn't be configurable -- though deleting ./node_modules after install should be safe if you'd want to pursue that instead

[mattyclarkson]

Hmm, it's installing optional dependencies which are the big ones.

Seems --omit=optional is needed to avoid that.

NPM 6 uses --no-optional which is still supported on the later NPM.

Any interest in adding --no-optional to the install command?

[asottile]

this is the actual relevant install command:

pre-commit/pre_commit/languages/node.py

Line 116 in e1ce4c0

install = ('npm', 'install', '-g', pkg, *additional_dependencies)

the command you're referring to is so pack can succeed and is the one that the npm developers recommended to us

[mattyclarkson]

Yep, the previous command is the one that is installing all the optional dependencies.

Oh, I see. OK, I'll need to debug what is going on then.

I'm pretty sure we can work around this with npm workspaces.

[asottile]

I'm pretty sure all you need to do is submit a patch to delete ./node_modules after the -g install -- it shouldn't be relevant / used after that point

[asottile]

but you'll need to do some research to make sure that's safe as well