npm package-spec aliases are not handled correctly

[sjd78]

npm package-spec allows for aliases: https://docs.npmjs.com/cli/v9/using-npm/package-spec?v=true#aliases

This allows a dependency block to look like:

  "dependencies": {
    "string-width": "^5.1.2",
    "string-width-cjs": "npm:string-width@^4.2.0",
  },

The corresponding package-lock.json will then look like:

    "node_modules/@isaacs/cliui": {
      "version": "8.0.2",
      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
      "dev": true,
      "dependencies": {
        "string-width": "^5.1.2",
        "string-width-cjs": "npm:string-width@^4.2.0",
      },
      "engines": {
        "node": ">=12"
      }
    },

and the reference then looks like:

    "node_modules/string-width-cjs": {
      "name": "string-width",
      "version": "4.2.3",
      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
      "dev": true,
      "dependencies": {
        "emoji-regex": "^8.0.0",
        "is-fullwidth-code-point": "^3.0.0",
        "strip-ansi": "^6.0.1"
      },
      "engines": {
        "node": ">=8"
      }
    },

but cachito is attempting to download string-width-cjs@npm:string-width-4.2.3.tgz which will not exist in npmjs.

Cachito should follow the alias before downloading.

[chmeliik]

Hello and thanks for the bug report

@taylormadore is currently working on a major refactoring to support v3 package-lock.json: #857. I think this issue will be resolved as part of that, but we'll need to verify.

[sjd78]

FWIW, depending on rimraf@^5.x will get the aliases included in its dependencies.

[chmeliik]

Npm v9 support has been released. Aliases are now handled properly in lockfile versions 2 and 3 (npm 7+), but still break in lockfile version 1.

Since your lockfile is version 2, aliases should work now 🎉