Repository navigation
[BUG] npm install fails with EACCES on a package.json with no EOF #3234
Description
Is there an existing issue for this?
- I have searched the existing issues
Current Behavior
NPM 7 fails with an EACCES error when npm install is run with a package.json that:
- does not have a new line at the end, AND
- the user does not have the permission to write to the
package.json.
It most likely happens because of npm/npm#18545
NPM 6 does not fail like this.
Expected Behavior
I would expect npm install to work even with only read permissions to package.json.
The EOF new line has no meaning there, everything should work fine without it (on most systems), NPM does not really need to write to the package.json so read rights should be enough to execute npm install.
NPM 6 most likely does not fail, because it runs with higher privileges and writes the EOF even if the permissions on the package.json prevent it, but that's a different issue.
Steps To Reproduce
npm init -y- remove EOF new line from
package.json chmod 444 package.jsonnpm i- NPM 7 fails with EACCES, NPM 6 keeps going
Environment
- OS: MacOs, various Linuxes
- Node: 15, 16
- npm: 7
Activity
mnmkng commentedon May 12, 2021
Also note that the error message is quite confusing, because the
openimplies a read problem and the fact thatnpm installwould write something to thepackage.jsonis an obscurity that we only found out by blind luck.And yeah, we mostly have end of file new lines everywhere, but in this particular case, we were generating the
package.jsonbyJSON.stringify(content)and therefore, no new line was there.darcyclarke commentedon Jun 18, 2021
Note: we don't want to change the permissions of
package.jsonfrom what you - as the user - have explicitely defined, so theEACCESSerror will persist if you've chmod'd the dir/file to prevent writes (this was incorrectly being allowed in v6) & we will always write files w/ a carriage return; What we can/will do here though is ensure we don't write the file if we don't see that line break (/cc @ruyadorno who should be in this code at the moment).mnmkng commentedon Jun 21, 2021
Yeah, agree and thank you. It totally makes sense to have EOF in files. We've fixed our permissions in the meantime, but I think it still makes sense for
npm installnot to fail for people who have only read permissions to thepackage.json.chore: @npmcli/package-json refactor
chore: @npmcli/package-json refactor
chore: @npmcli/package-json refactor
Bump npm from 7.10.0 to 7.19.1