[BUG] npm install a specific package version in workspaces do not work as expected

[Elyahou]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

I have two workspaces workspace_a and workspace_b using the same package dependency_a with different versions.

Changing the version of dependency_a in workspace_a using npm i dependency_a@version -w workspace_a have no effect and the version is not changed

Expected Behavior

Running npm i dependency_a@version -w workspace_a should change the version of dependency_a in workspace_a to the request version.

Steps To Reproduce

// Initialize project
$ npm init

// Initialize workspaces
$ npm init -w ./packages/a -w ./packages/b

// Install react 17 in all workspaces
npm install [email protected] --workpaces

// Install react 18 in workspace a
npm install [email protected] --workspace a

// Install back react 17 in workspace a
npm install [email protected] --workspace a

The last command to install react with version 17 to workspace a have no effect, and workspace a still use react 18 at this point. The output of the last command is:

up to date, audited 10 packages in 709ms

found 0 vulnerabilities

Environment

• npm: 9.5.1
• Node.js: v18.16.0
• OS Name: MacOS 12.5
• System Model Name: Macbook Pro

[electrovir]

I have similar issues (in the same environment), and just happened to go looking in here for bugs at this moment.

I only have one workspace currently. When I bump a dependency version in that one workspace and run npm i in the root, nothing changes. I've had to resort to running this script every time I change, add, or remove new dependencies:

rm -rf node_modules && rm -rf packages/*/node_modules && rm -f package-lock.json && npm i

(packages is where my workspaces are located)

[sysofwan]

We have the same issue. Updating package.json in a workspace to update package version and running npm install afterwards does not remove the previous version from the package-lock.json file. This creates a mismatch between requested version and package-lock.json version.

Here is a snippet of our package-lock.json. We requested @fluentui/[email protected] but the old @fluentui/[email protected] was not removed.

Running npm ls --package-lock-only will catch the mismatch.

The only way I know to fix this while preserving package-lock.json is to manually update the package-lock file.

[luin]

Same issue here. Looks like the only way to get package-lock.json synced with package.json in sub packages is rm -rf node_modules && rm -rf packages/*/node_modules && rm -f package-lock.json. Have to run the command several times in the past hour.

Node version: v20.10.0
npm version: 10.2.3

[TheBlindHawk]

Same issue here but with sub-dependencies

I just changed to npm workspaces and I noticed that I cannot have split versions depending on the workspace.
I have workspace_a running multiple libraries requiring uuid@8, and I have workspaces_b running the latest version of expo that requires uuid@3.
However it seems that npm workspaces does not build a node_module for each workspace, causing the root workspace to only contain one uuid package that I cannot change from version 8 to version 3 unless I change it for every workspace.

Current unideal solution: downgrade uuid to version 3 for every library on the root directory

Node version: 21.4.0
npm version: 10.2.4