fix: #8547, remove old deps during upgrade (#8557)

src/cli/package-install.js

@@ -8,6 +8,8 @@ const packageFilePath = path.join(__dirname, '../../package.json');
 const packageDefaultFilePath = path.join(__dirname, '../../install/package.json');
 const modulesPath = path.join(__dirname, '../../node_modules');
 
+const isPackage = /^nodebb-(plugin|theme|widget|reward)-\w+/;
+
 function updatePackageFile() {
 	let oldPackageContents = {};
 
@@ -20,7 +22,15 @@ function updatePackageFile() {
 	}
 
 	const defaultPackageContents = JSON.parse(fs.readFileSync(packageDefaultFilePath, 'utf8'));
-	const packageContents = { ...oldPackageContents, ...defaultPackageContents, dependencies: { ...oldPackageContents.dependencies, ...defaultPackageContents.dependencies } };
+
+	const dependencies = {};
+	Object.entries(oldPackageContents.dependencies).forEach(([dep, version]) => {
+		if (isPackage.test(dep)) {
+			dependencies[dep] = version;
+		}
+	});
+
+	const packageContents = { ...oldPackageContents, ...defaultPackageContents, dependencies: { ...dependencies, ...defaultPackageContents.dependencies } };
 
 	fs.writeFileSync(packageFilePath, JSON.stringify(packageContents, null, 2));
 }
@@ -83,7 +93,6 @@ function preserveExtraneousPlugins() {
 		return;
 	}
 
-	const isPackage = /^nodebb-(plugin|theme|widget|reward)-\w+/;
 	const packages = fs.readdirSync(modulesPath).filter(function (pkgName) {
 		return isPackage.test(pkgName);
 	});

test/package-install.js

@@ -0,0 +1,30 @@
+'use strict';
+
+
+const { execSync } = require('child_process');
+const path = require('path');
+const { readFileSync } = require('fs');
+
+var assert = require('assert');
+
+describe('Package install', function () {
+	it('should remove non-`nodebb-` modules not specified in `install/package.json`', function () {
+		const packageFilePath = path.join(__dirname, '../package.json');
+
+		// install an extra package
+		// chose dotenv because it's a popular package
+		// and we use nconf instead
+		execSync('npm install dotenv --save --production');
+
+		// assert it saves in package.json
+		const packageWithExtras = JSON.parse(readFileSync(packageFilePath, 'utf8'));
+		assert(packageWithExtras.dependencies.dotenv, 'dependency did not save');
+
+		// update the package file
+		require('../src/cli/package-install').updatePackageFile();
+
+		// assert it removed the extra package
+		const packageCleaned = JSON.parse(readFileSync(packageFilePath, 'utf8'));
+		assert(!packageCleaned.dependencies.dotenv, 'dependency was not removed');
+	});
+});