[BUG] The version of untagged git+file dependency is replaced unexpectedly

[proletarius101]

Current Behavior:

The version of untagged git+file dependency is replaced by a "newer" version (as in the version field of package.json), which doesn't exist as a tag. So npm will try to search it via the internet, which is a no-go for the --offline mode.

Expected Behavior:

Keep the version as-is.

Steps To Reproduce:

Say, I have a git+file dependency:

    "decrypt": "git+file:/****/decrypt-5d487038d3568d180e7cf561d774e1b685985d62#5d487038d3568d180e7cf561d774e1b685985d62",

where 5d487038d3568d180e7cf561d774e1b685985d62 is the commit hash of the desired version.

If the repo at /****/decrypt-5d487038d3568d180e7cf561d774e1b685985d62 is not tagged at all, but having a version field in the package.json, it will

17 info lifecycle decrypt@1.0.2~prepack: decrypt@1.0.2
18 info lifecycle decrypt@1.0.2~postpack: decrypt@1.0.2
...

21 silly removeObsoleteDep removing decrypt@github:standardnotes/decrypt#5d487038d3568d180e7cf561d774e1b685985d62 from the tree as its been replaced by a newer version or is no longer required
22 silly removeObsoleteDep removing @standardnotes/sncrypto-web@1.2.9 from the tree as its been replaced by a newer version or is no longer required
23 silly removeObsoleteDep removing @standardnotes/sncrypto-common@1.2.9 from the tree as its been replaced by a newer version or is no longer required
24 silly removeObsoleteDep removing libsodium-wrappers@0.7.8 from the tree as its been replaced by a newer version or is no longer required
25 silly removeObsoleteDep removing libsodium@0.7.8 from the tree as its been replaced by a newer version or is no longer required
26 silly removeObsoleteDep removing @standardnotes/snjs@2.0.22 from the tree as its been replaced by a newer version or is no longer required

Environment:

❯ npm -v
6.14.10

[proletarius101]

Related: flatpak/flatpak-builder-tools#182

[darcyclarke]

npm v6 is no longer in active development; We will continue to push security releases to v6 at our team's discretion as-per our Support Policy.

If your bug is preproducible on v7, please re-file this issue using our new issue template.

If your issue was a feature request, please consider opening a new RRFC or RFC. If your issue was a question or other idea that was not CLI-specific, consider opening a discussion on our feedback repo