npm --only=prod installs dependencies of shrinkwrapped devDependencies

[jdmarshall]

What / Why

npm install --only=prod should not be touching devDependencies, full stop.

When

all clean installs

Where

working directory

How

Current Behavior

node_modules/foo/ contains only a node_modules directory, with all of foo's dependencies

Steps to Reproduce

• reproducible with npm 6.11.3 and npm 6.13.4
• Publish a module 'foo' containing a shrinkwrap file.
• Add it as a devDependency in the module under test
• rm -rf node_modules package-lock.json npm-shrinkwrap.json && npm install --only=prod

Expected Behavior

node_modules should not contain any devDependencies

Who

• n/a

References

• n/a

[jdmarshall]

#492 is a little vague and I can't tell if this is the same issue. It seems to present in a different manner.