npm / npm/cli

[BUG] `--legacy-peer-deps` doesn't work for `npm audit fix`

Open
#4,966 3 comments 7 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Priority 1 Release 8.x
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
This issue exists in the latest npm version
  • I am using the latest npm
Current Behavior

As per npm-audit documentations, I'd expect flag --legacy-peer-deps to work with npm audit fix. It does not.

... since npm audit fix runs a full-fledged npm install under the hood, all configs that apply to the installer will also apply to npm install -- so things like npm audit fix --package-lock-only will work as expected.

Expected Behavior

Flag --legacy-peer-deps should work with npm audit fix

Steps To Reproduce

I ran npm audit fix and encountered this error

npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR!
npm ERR! While resolving: my-package-name@1.2.3
npm ERR! Found: react-scripts@5.0.1
npm ERR! node_modules/react-scripts
npm ERR!   react-scripts@"^5.0.1" from the root project
npm ERR!
npm ERR! Could not resolve dependency:
npm ERR! peer react-scripts@"^4.0.0" from @craco/craco@6.4.3
npm ERR! node_modules/@craco/craco
npm ERR!   @craco/craco@"^6.1.2" from the root project
npm ERR!
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.

I ran again with npm audit fix --legacy-peer-deps to no effect. The error was exactly the same.

Environment
  • npm: 8.11.0
  • Node.js: 16.15.0
  • OS Name: MacOS 12.3.1
  • System Model Name: MacBook Air M1 (2020)
  • npm config:
; "user" config from /Users/nghiavt/.npmrc

@fortawesome:registry = "https://npm.fontawesome.com/"
//npm.fontawesome.com/:_authToken = (protected)
registry = "https://registry.npmjs.org/"

; node bin location = /Users/nghiavt/.nvm/versions/node/v16.15.0/bin/node
; node version = v16.15.0
; npm local prefix = /Users/nghiavt/Projects/(protected)
; npm version = 8.11.0
; cwd = /Users/nghiavt/Projects/(protected)
; HOME = /Users/nghiavt
; Run `npm config ls -l` to show all defaults.```

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the npm audit fix command and the npm-audit documentation referenced in the issue, then reproduce the dependency-resolution error with and without --legacy-peer-deps. Trace how installer configuration is passed during audit fix; done when the flag changes dependency resolution as expected and the reported conflict is handled.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
cli, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.