No way to prevent package.json update with cordova commands even with --nosave

With Cordova 7, cordova commands including cordova platform add and cordova prepare will copy plugin information from config.xml to package.json.

According to the saving platforms documentation, using -nosave should prevent updating package.json or config.xml, but this does not work (i.e. using -nosave still seems to update the package.json.

I want to avoid updating package.json specifically because there doesn't seem to be a way to avoid hard coding variables for plugins. An example is the cordova fabric plugin:

  <plugin name="cordova-fabric-plugin" spec="^1.1.9">
    <variable name="FABRIC_API_KEY" value="a" />
    <variable name="FABRIC_API_SECRET" value="b" />
  </plugin>

Cordova doesn't seem to provide a way for you to parameterize variables in the configuration. To get around this, I have build.config.xml where they are parameterized, and config.xml is created at install-time and not version controlled. However, this would be much more difficult to do with package.json and is practically not an option.

When running cordova platform add ios --nosave with the above plugin, cordova still updates package.json to include the fabric plugin with the hard coded variables.

• Cordova 6 question (with solution): https://stackoverflow.com/questions/37816035/using-environment-variables-parameterizing-config-xml
• Cordova 7 question (no solution yet) https://stackoverflow.com/questions/46816928/parameterize-do-not-hard-code-variables-when-building-with-cordova-7

Ideally --nosave would not update package.json as advertised. Even better, there should be a way to set up a cordova project so that any cordova commands do not save by default. This would prevent mistakes in a larger team and allow use of tools that wrap cordova such as ionic.