Broken npm ci since forks replaced official dependencies

Hello,

It appears that recent changes in package.json have broken the npm ci with npm < v7.x

Probably due to changes to the lockfile.

Prior to npm 7 yarn.lock files were ignored

Source: https://github.blog/2020-10-13-presenting-v7-0-0-of-the-npm-cli/

Steps to reproduce the error with npm 6

cat '{
  "name": "test-project",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "",
  "license": "ISC",
  "dependencies": {
    "plotly.js": "^2.5.0"
  }
}' > package.json

npm install --package-lock-only
npm ci

npm ci exists with the following error:

npm ERR! code ETARGET
npm ERR! notarget No matching version found for zero-crossings@1.1.0.
npm ERR! notarget In most cases you or one of your dependencies are requesting
npm ERR! notarget a package version that doesn't exist.

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/aurelienbaumann/.npm/_logs/2021-09-07T20_14_08_058Z-debug.log

Looking in package-lock.json to see the details about zero-crossings, I can see the resolved field is ignored.

"zero-crossings": {
  "version": "1.1.0",
  "resolved": "git+https://github.com/plotly/zero-crossings.git#4746771f490344e21c84d1f631cb661d8c5ff508"
}

We should probably find a workaround this if we want to keep supporting npm < 7.

[nicolaskruchten]

We’re looking into this! In general, we recommend that folks depend upon a prebuilt bundle like plotly.js-dist or create a custom bundle and include that in their source tree, rather than depending upon plotly.js directly. We’ll try to fix this, but we don’t rigorously test this case so we may break it again in the future.

[sepans]

We are having the same issue when trying to build the package on a build/ci machine that doesn’t have open access to the internet (e.g. github). I used plotly.js-dist and bundle customization referenced in https://github.com/plotly/react-plotly.js/pull/260 and now the builds are working.