[BUG] package-lock is not cleaned up completely when workspace is removed

[gribnoysup]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

After removing workspace from project and updating package-lock with npm install, some references to the removed workspace still exist

Expected Behavior

All references of the removed package are removed from package-lock

Steps To Reproduce

1. Create a basic npm workspace

mkdir new-project
cd new-project
npm init -y
npm init -y -w ./packages/a
npm init -y -w ./packages/b

2. Check package-lock file

{
  "name": "npm-workspace-remove",
  "version": "1.0.0",
  "lockfileVersion": 2,
  "requires": true,
  "packages": {
    "": {
      "name": "npm-workspace-remove",
      "version": "1.0.0",
      "license": "ISC",
      "workspaces": [
        "packages/a",
        "packages/b"
      ]
    },
    "node_modules/a": {
      "resolved": "packages/a",
      "link": true
    },
    "node_modules/b": {
      "resolved": "packages/b",
      "link": true
    },
    "packages/a": {
      "version": "1.0.0",
      "license": "ISC"
    },
    "packages/b": {
      "version": "1.0.0",
      "license": "ISC",
      "devDependencies": {}
    }
  },
  "dependencies": {
    "a": {
      "version": "file:packages/a"
    },
    "b": {
      "version": "file:packages/b"
    }
  }
}

3. Remove one of the workspaces

rm -rf packages/b

4. Update the lock file with npm install and check the package-lock again

{
  "name": "npm-workspace-remove",
  "version": "1.0.0",
  "lockfileVersion": 2,
  "requires": true,
  "packages": {
    "": {
      "name": "npm-workspace-remove",
      "version": "1.0.0",
      "license": "ISC",
      "workspaces": [
        "packages/a"
      ]
    },
    "node_modules/a": {
      "resolved": "packages/a",
      "link": true
    },
    "packages/a": {
      "version": "1.0.0",
      "license": "ISC"
    },
    "packages/b": {
      "version": "1.0.0",
      "extraneous": true,
      "license": "ISC",
      "devDependencies": {}
    }
  },
  "dependencies": {
    "a": {
      "version": "file:packages/a"
    }
  }
}

You can see that "packages/b" part is still there

Environment

• npm: 8.19.1
• Node.js: v16.15.1
• OS Name: macOS Monterey 12.5.1
• System Model Name: Macbook Pro
• npm config:

; "user" config from /Users/sergey.petushkov/.npmrc

//localhost:4873/:_authToken = (protected)
//registry.npmjs.org/:_authToken = (protected)

; node bin location = /Users/sergey.petushkov/.nvm/versions/node/v16.15.1/bin/node
; node version = v16.15.1
; npm local prefix = /Users/sergey.petushkov/Projects/MongoDB/npm-workspace-remove
; npm version = 8.19.1
; cwd = /Users/sergey.petushkov/Projects/MongoDB/npm-workspace-remove
; HOME = /Users/sergey.petushkov
; Run `npm config ls -l` to show all defaults.

[maksnester]

Hey, that just caused my CI build to fail. Why do we still have to manually edit the package-lock file?

[wildlyinaccurate]

I really wish this would be fixed. What an annoying bug!

[richardkazuomiller]

Since npm is able to mark them as extraneous it seem slike not a huge stretch to go one step further and remove them with prune or something 🤔