From my understanding and experiment, the problem seems related to how package-lock.json
work. I setup a lib with one dependency set to
"fn-with-hooks": "git+ssh://git@github.com/hackape/fn-with-hooks.git#master"
and initial npm install
would generate a package-lock.json
that contains
"fn-with-hooks": {
"version": "git+ssh://git@github.com/hackape/fn-with-hooks.git#fa1e21a8ea2fd2b0b7ec5897b954266791b56ac4",
"from": "git+ssh://git@github.com/hackape/fn-with-hooks.git#master"
},
As you can see, the version
field is locked to a specific commit hash, and subsequential call to npm install
will not change this version field, thus prevents "tracking" the branch up to latest commit. It's just how lockfile is supposed work.
Remove package-lock.json
, (no need to remove node_module/lib
) then npm install
can resolve this problem.
My immediate thought is try to exclude this specific lib from package-lock.json
. But the npm lockfile is a whole-sale solution and provide no such fine-grain control.
So the only option down this path is to disable package-lock.json
.
If you still intent to use package-lock.json
, one workaround is to mannually run npm update lib-name
command to force update that lib to latest version. This will also update the version
field in lockfile accordingly.
update
I’m not sure why npm update
doesn’t work on your side. It works on mine. Maybe you want to double check if it’s indeed the fact, or your misunderstanding. Although I seriously doubt it is, it could also be npm version difference. I’m using v12.14.
I have another workaround, which I tried and it worked. You don’t have to delete the whole package-lock.json
file, you can rewrite it to just exclude the record of that git-base lib. This way npm lacks the lockdown information, so it’s force to re-fetch your lib. The other lib records in lockfile remain untouched, so limits the scope of influence.
npm ci
should take only package-lock into account, from which I fully expect to fix itself to specific commit). – paul23 Oct 6 '20 at 15:56