save: If a shrinkwrap already has dev deps, make sure they're kept

When running `install --save` in a folder with a shrinkwrap that has
dev-only dependencies in it, it's important that we don't then throw
away the dev dependencies just because they didn't say
`install --save --also=dev`.

PR-URL: https://github.com/npm/npm/pull/9992
Fixes: #9647

1 files changed, 21 insertions, 2 deletions

diff --git a/lib/install/save.js b/lib/install/save.js
index aaa801a63..efe0e20ad 100644
--- a/lib/install/save.js
+++ b/lib/install/save.js
@@ -46,9 +46,28 @@ function saveShrinkwrap (tree, next) {
     var save = npm.config.get('save')
     var saveDev = npm.config.get('save-dev')
     var saveOptional = npm.config.get('save-optional')
-    if (!saveOptional && saveDev) return next()
+
+    var shrinkwrap = tree.package._shrinkwrap || {dependencies: {}}
+    var hasDevOnlyDeps = tree.requires.filter(function (dep) {
+      var devReqs = dep.package._requiredBy.filter(function (name) { return name.substr(0, 4) === '#DEV' })
+      return devReqs.length === dep.package._requiredBy.length
+    }).some(function (dep) {
+      return shrinkwrap.dependencies[dep.package.name] != null
+    })
+
+    if (!saveOptional && saveDev && !hasDevOnlyDeps) return next()
     if (saveOptional || !save) return next()
-    npm.commands.shrinkwrap([], true, next)
+
+    if (hasDevOnlyDeps) {
+      var dev = npm.config.get('dev')
+      npm.config.set('dev', true)
+      npm.commands.shrinkwrap([], true, function () {
+        npm.config.set('dev', dev)
+        next.apply(this, arguments)
+      })
+    } else {
+      npm.commands.shrinkwrap([], true, next)
+    }
   })
 }