[BUG] npm ls --depth=Infinity returns dev dependencies of local prod dependencies

[pawelhertman]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

If there is a prod dependency installed from the local filesystem and it has dev dependencies, npm ls --depth=Infinity returns also dev dependencies although it doesn't do this for dependencies installed from the public NPM registry. Depth parameter value doesn't matter - it just has to be more than 0.
It worked fine in npm v6.

Expected Behavior

All dev dependencies except direct ones (depth=0) should not be listed when calling npm ls --depth=Infinity

Steps To Reproduce

1. Create an NPM project
2. Configure a local prod dependency, let's call it "A"
3. Add a local dev dependency to the package "A", let's call it "AX"
4. Install dependencies: npm install
5. Type npm ls --depth=Infitnity
6. Notice the "AX" package it also listed

My example

Package.json:

npm ls result:

Explanation: all packages ending with "X" in the name are dev dependencies and they shouldn't be listed the same way as dev dependencies of "adm-zip" package aren't. The "x" package is a dev dependency but it's a direct dependency of the module so it should (and is, correctly) be listed.

adm-zip's package.json file from node_modules (an evidence that is has dev dependencies and they weren't listed):

Environment

• OS: macOS Catalina 10.15.7
• Node: 16.5.0
• npm: 7.19.1

[nlf]

npm ls by default does show dev dependencies of the project root, we only omit them if you explicitly tell us to.

the reason you're seeing the dev dependencies of your file: dependencies, is because what we actually do is create a symlink in node_modules pointing to the directory the code resides in. if that directory has a node_modules in it, then everything there will be displayed by npm ls

the current behavior is intended and is working correctly. if you want to omit dev dependencies npm ls --depth=Infinity --omit=dev should do the trick nicely.