question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

@types/eslint-scope@3.7.2 dependency doesn't exist but is present in yarn.lock

See original GitHub issue

Bug report

What is the current behavior? Webpack has a direct dependency to a nonexistent package (@types/eslint-scope@3.7.2)

If the current behavior is a bug, please provide the steps to reproduce.

What is the expected behavior? Webpack should not have a direct dependency to a nonexistent package (@types/eslint-scope@3.7.2)

Other relevant information: webpack version: 5.65.0 Node.js version: 14.16.1 Operating System: Windows 10 Additional tools: Angular 12 / Angular 13

Issue Analytics

  • State:closed
  • Created 2 years ago
  • Reactions:1
  • Comments:7 (3 by maintainers)

github_iconTop GitHub Comments

1reaction
alexander-akaitcommented, Dec 29, 2021

I think we can close it because 3.7.2 in npm register (https://www.npmjs.com/package/@types/eslint-scope), also our lock file has no effect on your project, maybe something was wrong with the register, I can’t reproduce it locally, feel free to feedback, also we have https://github.com/webpack/webpack/blob/main/package.json#L8, i.e. 3.7.0

1reaction
denyseflocommented, Dec 27, 2021

I agree, this problem is present in almost all Webpack v5.x.x versions. @types/eslint-scope@3.7.2 has been flagged has malicious and removed from npm : https://eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes

Read more comments on GitHub >

github_iconTop Results From Across the Web

yarn install changes yarn.lock file · Issue #4379 - GitHub
Notice that the yarn.lock file has changed. What is the expected behavior? Installing should not change the lock file if it already exists....
Read more >
yarn.lock
Yarn needs to store exactly which versions of each dependency were installed. To do this Yarn uses a yarn.lock file in the root...
Read more >
Yarn lock: how it works and what you risk without maintaining ...
When present in the project, yarn.lock is the main source of information about the current versions of dependencies in a project.
Read more >
yarn.lock file is not updating after I update the version of a ...
Try using yarn install --force as this will re-download all packages (in their locked versions unless too old) and refresh the lock file...
Read more >
How Yarn Lock Files Work and Upgrading Dependencies
This article has a goal of explaining the purpose of a yarn.lock file as well as how to upgrade dependencies when a lock...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found