[BUG] npm ls --long --json does not show license of dependencies

[timhaines]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Running npm ls --long --json does not show the license field in dependencies, if npmv7 was used to install the packages.

npm ls --long --json does show the license field in dependencies if npmv6 was used to install the packages, even when npmv7 is used to run the ls command.

Expected Behavior

Expect to see the license field in the output for dependencies when npm ls --long --json is run.

Steps To Reproduce

1. Run npm i with npm v7
2. Run npm ls --long --json with npm v7
3. Observe licenses field is missing for dependencies.

To observe better behaviour,

1. Run npm i with npm v6
2. Run npm ls --long --json with npm v7 (or v6)
3. Observe licenses field is present for dependencies.

Environment

• OS: macos
• Node: v16.5.0
• npm: 7.20.5

[timhaines]

If I delete the node_modules/.package-lock.json file, the licenses appear in the npm ls output as expected.

Paraphrasing friendly notes from someone else who knows about this:

The minified packument objects being served by the registry don't include the license fields.
npm 7 assumes that the lockfile it generates is complete, so it doesn't re-check the data against the package.json files or registry manifests, since it's better performance to just not do that.
As the data from the registry doesn't include the licenses field, then the data in the .package-lock.json is incomplete.
```.

[ljharb]

Seems like the simple solution is to include license data in the hidden lockfile?

[lukekarrys]

In #7475 the behavior was fixed so license will now be stored in (hidden) lockfiles. That makes npm ls --long --json work to show the license field again.

This fix will be included in npm@10.8.0. Once that is released you will need to rebuild your lockfiles and then npm ls should contain licenses again.