Dependencies aren't included when they are a dependency of devDependencies

This is a Bug Report

Description

Serverless package doesn’t correctly add node_modules when a node module is also a dependency of a devDependency

I have a package.json that contains this :

{
  "name": "myapp",
  "version": "1.0.0",
  "private": true,
  "dependencies": {
    "bluebird": "^3.5.0",
    "moment": "^2.18.1"
  },
  "devDependencies": {
    "aws-sdk": "*",
    "serverless": "^1.18.0"
  }
}

When I run serverless package then extract the resulting zip file, the node_modules folder only contains a .bin folder.

I think that this is due to the way the excludeDevDependencies functionality works.

I’m wondering if the issue might be coming from the fact that, as the serverless module relies on moment and bluedbird they are in the list of dependencies when running npm ls --dev=true but not added back when running npm ls --prod=true.

Similar or dependent issues:

This is probably related to #3889

Additional Data

• Serverless 1.18.0
• MacOS Sierra
• package is created correctly ( but with the devDependencies) if I use excludeDevDependencies: false

[pmuens]

Just a quick update for everyone who is reading this right now / is blocked by this bug.

There’s a config available to opt-out of dev dependency exclusion you can use in the meantime:

package:
  excludeDevDependencies: false

https://serverless.com/framework/docs/providers/aws/guide/packaging/#development-dependencies

[davidgovea]

Added a pull request #3975 for this. In short, a second temporary file is used for the --prod=true dependencies, and then lodash’s .difference() is used to make sure we preserve any explicitly-needed dependencies:

const dependenciesToExclude = _.difference(devDependencies, prodDependencies)