使用--omit=dev无法排除npm开发依赖的问题求助

我尝试了以下命令，node_modules中的开发依赖文件夹（如@loki）已被清空，但package-lock.json里依然保留着devDependencies相关条目：

npm install --omit=dev
npm prune --production
npm install --omit=dev --omit=optional

当前环境为npm 10、Node.js 18.17。我的package.json内容如下：

{
  "name": "@prefixx/components12",
  "version": "2.3.18",
  "types": "dist/index.d.ts",
  "module": "dist/components12.mjs",
  "main": "dist/components12.js",
  "files": [
    "dist"
  ],
  "scripts": {
    "serve": "storybook dev -p 6007 --ci",
    "dev": "storybook dev -p 6007",
    "build:storybook": "cross-env STORYBOOK_BUILD=true storybook build -o ../../storybook-static/native",
    "build": "vite build"
  },
  "dependencies": {
    "lit": "^3.1.1",
    "lit-html": "^3.1.1"
  },
  "devDependencies": {
    "@floating-ui/dom": "^1.2.8",
    "@tailwindcss/forms": "0.5.3",
    "@tailwindcss/line-clamp": "0.4.4",
    "autoprefixer": "^10.4.12",
    "composed-offset-position": "^0.0.4",
    "flatpickr": "4.6.13",
    "loki": "^0.33.1",
    "postcss": "^8.4.18",
    "rollup-plugin-ignore": "^1.0.10",
    "tailwindcss": "^3.2.0"
  }
}

package-lock.json部分代码：

{
  "name": "@eliagroup-innersource/nova-components-native",
  "version": "2.3.18",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@eliagroup-innersource/nova-components-native",
      "version": "2.3.18",
      "dependencies": {
        "lit": "^3.1.1",
        "lit-html": "^3.1.1"
      },
      "devDependencies": {
        "@eliagroup-innersource/nova-core": "2.3.0",
        "@floating-ui/dom": "^1.2.8",
        "@tailwindcss/forms": "0.5.3",
        "@tailwindcss/line-clamp": "0.4.4",
        "autoprefixer": "^10.4.12",
        "composed-offset-position": "^0.0.4",
        "flatpickr": "4.6.13",
        "loki": "^0.33.1",
        "postcss": "^8.4.18",
        "rollup-plugin-ignore": "^1.0.10",
        "tailwindcss": "^3.2.0"
      }
    },

....

 "node_modules/@loki/browser": {
      "version": "0.33.0",
      "resolved": "https://registry.npmjs.org/@loki/browser/-/browser-0.33.0.tgz",
      "integrity": "sha512-PpgzttbfjLh2fkkObM1ljPd4guqwbMpuH+wefwef+qJBhwQ==",
      "dev": true,
      "dependencies": {
        "@loki/integration-core": "^0.33.0"
      }
    },
    "node_modules/@loki/core": {
      "version": "0.33.0",
      "resolved": "https://registry.npmjs.org/@loki/core/-/core-0.33.0.tgz",
      "integrity": "sha512-TbgKfAfxYxQffRIwSYelhkC2y4/wegwe==",
      "dev": true,
      "dependencies": {
        "mime-types": "^2.1.35",
        "shelljs": "^0.8.3"
      }
    },

....

其中loki因使用旧版axios存在npm audit检测到的漏洞，我不希望生产环境中保留这类开发依赖的任何记录。

1. 彻底重建lockfile（最可靠） #

npm 10的lockfile默认会保留所有依赖的历史记录，即使你省略了dev依赖。要彻底清除dev依赖条目，最直接的方式是从头重建lockfile：

# 删除现有lockfile和node_modules
rm -rf package-lock.json node_modules
# 仅安装生产依赖，生成全新的lockfile
npm install --omit=dev

新生成的package-lock.json将只包含生产依赖的相关条目，不会保留任何dev依赖的记录。

2. 清理lockfile中的冗余dev依赖条目 #

如果不想完全删除lockfile，可以尝试用dedupe命令整理依赖树，移除未被生产依赖引用的dev依赖：

npm dedupe --omit=dev

注意：这种方式可能无法彻底清除所有dev依赖条目，尤其是如果之前lockfile中记录了复杂的依赖关系。

3. 确认无生产依赖间接引入dev依赖 #

极少数情况下，dev依赖可能被生产依赖间接引入，你可以用以下命令排查生产依赖树：

npm list --omit=dev

如果发现dev依赖出现在输出中，需要进一步确认该依赖是否为生产环境必需，或者排查依赖链找到引入源头。

关于npm audit的补充说明 #

即使lockfile中暂时保留了dev依赖条目，只要node_modules中没有安装这些依赖，默认npm audit不会检测它们的漏洞。你也可以明确指定只检测生产依赖：

npm audit --omit=dev

内容的提问来源于stack exchange，提问作者flieks