npm-module-bug-reports

2020-10-01 mocha devDependency adds content to node_modules after npm install --production

Sometime between Wednesday September 30th 2020 and Thursday October 1st 2020, the behavior of mocha during a clean npm install --production changed. Previously, the command resulted in no node_modules folder being created. Since, the command has consitently resulted in the creation of a node_modules folder with the following contents:

  • define-properties
  • es-abstract
  • es-to-primitive
  • function-bind
  • has
  • has-symbols
  • is-callable
  • is-date-object
  • is-regex
  • is-symbol
  • object-inspect
  • object-keys
  • string.prototype.trimend
  • string.prototype.trimstart

This is an important issue as AWS Lambda@Edge code packages have a size limitation of 1048576 bytes, and the automated build tooling provided by AWS SAM will include these node_modules contents, violating the service limit. The only workaround is to add a cleanup step in the build process to delete the node_modules folder after building but before publishing the package for use in Lambda@Edge.

Steps to reproduce

  1. git clone https://github.com/danludwig/npm-module-bug-reports.git
  2. cd npm-module-bug-reports/mocha-2020-10-bug
  3. Observe that the ./package.json has only a devDependency on mocha
  4. npm install --production
  5. Observe that a node_modules folder was created with the above listed contents.

Expected behavior

  1. cd ../mocha-2020-10-expected
  2. Observe that the ./package.json has only a devDependency on chai
  3. npm install --production
  4. Observe that no node_modules folder was created.