How can I forcibly exclude a nested dependency for NPM?

Question

I'm using node 0.10.x and npm 2.15.0, I want to forcibly exclude a nested dependency that ends up being installed.

So far I've tried to create npm-shrinkwrap.json and manually edited it to remvoe the nested dependency but after running rm -rf node_modules && npm install ... I can still see the nested dependency being built for:

[email protected] install /.../node_modules/loopback-connector-mongodb/node_modules/mongodb/node_modules/kerberos
(node-gyp rebuild) || (exit 0)
CXX(target) Release/obj.target/kerberos/lib/kerberos.o
CXX(target) Release/obj.target/kerberos/lib/worker.o
CC(target) Release/obj.target/kerberos/lib/kerberosgss.o
CC(target) Release/obj.target/kerberos/lib/base64.o
CXX(target) Release/obj.target/kerberos/lib/kerberos_context.o
SOLINK_MODULE(target) Release/kerberos.node

Answer 1

npm >= 8.3.0

Using the overrides feature of newer versions of npm it is now possible to prevent a dependency of a dependency from being installed by replacing it with a link to the local file system. It's a bit of a hack, but it works both on Unix and on Windows.

First, make sure that you are using npm 8.3.0 or later. Enter in the command line:

npm -v

to see the version of npm installed.

Now, looking at the example in the question, let's say one of your dependencies has installed an old version of mongodb which in turn has installed kerberos in your node_modules folder.

You don't use kerberos anyway and you don't want it to be installed by npm install, so edit the "overrides" section of your package.json file like this:

package.json

{
  ...
  "overrides": {
    "kerberos": "../_EXCLUDED_"
  },
  ...
}

Be sure to run npm install again after this change. This will create a symbolic link (Unix) or a junction (Windows):

node_modules/mongodb/node_modules/kerberos -> node_modules/mongodb/node_modules/_EXCLUDED_

It is intended that the target of the symlink does not exist: with this, every attempt to load kerberos using require or import will result an easily detectable error:

Error: Cannot find module 'kerberos'

This should save you from the pain of debugging errors caused by excluding a dependency that is required.