npm WARN/notice are logged as error in sbt

[exoego]

Some messages, that are publishd by npm internally, are logged as [error] in sbt console.

[error] npm notice created a lockfile as package-lock.json. You should commit this file.
[error] npm WARN [email protected] requires a peer of aws-sdk@^2.83.0 but none is installed. You must install peer dependencies yourself.
[error] npm WARN optional SKIPPING OPTIONAL DEPENDENCY: [email protected] (node_modules/fsevents):
[error] npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for [email protected]: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})

As npm says those are just WARNING/notice, my scalajs project works fine even though [error]. So I think scalajs-bundler should prints such messages as [warn] or [info].

[sjrd]

That will probably be difficult to address. It happens because npm logs those things to its stderr, and stderr messages are rerouted to [error]. There is no general way to distinguish a "warning" from an "error" based on stdout and stderr.

[cquiroz]

Could it be ok to filter those messages in an ad-hoc way? e.g. messages starting with warning or containing WARN?

It wouldn't catch all the cases nor be very elegant but it would help in some cases

[unarist]

Since security audit warnings mentioned in https://github.com/scalacenter/scalajs-bundler/pull/268#issuecomment-430819521 is printed to stdout, it can be [info] level as well as other stdout messages (fixed at #271).

However, still I don't think "treat npm WARN as info, otherwise error" is not good because:

• There are blank lines in stderr of npm install, which is difficult to distinguish
• webpack-dev-server also prints info-level messages to stderr
  • Their warnings/errors have a keyword WARNING ERROR, but it may be multiline (see below).
• Most other commands (yarn, webpack-cli, etc.) only prints error to stderr

So I wonder if we treat all stderr messages from npm (but not yarn) and webpack-dev-server as [info] level. Users can see details of the failure by reading info messages when it fails by non-zero retval.

(but it would need some stderr handler in parameters of Commands.run Commands.start?)

[fallenreaper]

I wanted to follow up with this. I was noticing this with leveraging npmInstallDependencies, it will do an INSTALL on all my packages but it will print out stuff like:

[error] npm timing npm:load:whichnode Completed in 0ms
[error] npm timing config:load:defaults Completed in 0ms
[error] npm timing config:load:file:/opt/homebrew/lib/node_modules/npm/npmrc Completed in 2ms
[error] npm timing config:load:builtin Completed in 2ms
[error] npm timing config:load:cli Completed in 1ms
[error] npm timing config:load:env Completed in 0ms
[error] npm timing config:load:file:/Users/xxx/Documents/code/aa/scalajs-bundler/main/.npmrc Completed in 0ms
[error] npm timing config:load:project Completed in 2ms
[error] npm timing config:load:file:/Users/xxx/.npmrc Completed in 1ms
[error] npm timing config:load:user Completed in 1ms
[error] npm timing config:load:file:/opt/homebrew/etc/npmrc Completed in 0ms
[error] npm timing config:load:global Completed in 0ms
[error] npm timing config:load:validate Completed in 1ms
[error] npm timing config:load:credentials Completed in 0ms
[error] npm timing config:load:setEnvs Completed in 0ms

which is annoying to me because these are being reported as errors though only informational. Then ill notice that i will do a security audit which will POST and return a 400 which is an ACTUAL error. So it is hard to differentiate Errors vs Info vs Logs.

Error Sample:

[error] npm http fetch POST 400 https://samplerepo.com/foo/bar 99ms

Has this been address in general yet?

I am currently using:

sbt --version
sbt version in this project:    1.7.1
sbt script version: 1.7.1
scala --version
Scala code runner version 3.2.0 -- Copyright 2002-2022, LAMP/EPFL

sbt file vars
lazy val ScalaCheckVersion = "1.15.4"
lazy val ScalacheckEffectVersion = "1.0.2"
lazy val WebpackVersion = "5.74.0"
lazy val ScalaJSReactVersion = "2.1.1"
lazy val ReactJSVersion = "17.0.2"
lazy val ScalaJSJavaTimeVersion = "2.3.0"

Though i am curious, if it is still a problem and is unsure how to fix, maybe we should by default see if there is a way for NPM to supress information / log stuff, and only show Errors on install, which could be a configurable within the SBT scripts. Then the use of &1 would not get the info or logs in general which would prevent it from being picked up by sbt

Since NPM itself has log levels, https://docs.npmjs.com/cli/v8/using-npm/logging , we should be able to in SBT leverage that for the install command. That way it will push the commands into the npm, and would not print out the info or warnings, or whatever else.