[BUG] npm 8 allows incorrect peer dependencies when upgrading a v1 lockfile to v2.
Open
@siemhesda is already working on this.
Since Dec 13, 2023.
Bug
Priority 1
Release 8.x
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
When npm 8 installs from a v1 lockfile it does not error on incorrect peer dependencies. It doesn't print any peer dependency warnings and exits successfully.
Expected Behavior
I expect npm 8 to error on invalid peer dependencies.
Steps To Reproduce
- Create a npm package with incorrect peer dependencies. ts-node depends on typescript@>=2.7, I choose this arbitrarily.
{
"dependencies": {
"typescript": "1.8.0",
"ts-node": "9.1.1"
}
}
- Run npm 6 install to create a v1 lockfile.
$ npx npm@6 install
npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN ts-node@9.1.1 requires a peer of typescript@>=2.7 but none is installed. You must install peer dependencies yourself.
added 10 packages from 44 contributors in 2.371s
exit 0
- run npm 8 (8.12.2 at time of writing) to update to a v2 lockfile.
$ npx npm@8 install
npm WARN old lockfile
npm WARN old lockfile The package-lock.json file was created with an old version of npm,
npm WARN old lockfile so supplemental metadata must be fetched from the registry.
npm WARN old lockfile
npm WARN old lockfile This is a one-time fix-up, please be patient...
npm WARN old lockfile
up to date in 2s
exit 0.
This is unexpected. I expect npm 8 to error on incorrect peer dependencies. A subsequent install will error
$ npx npm@8 install
npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
exit 1
Environment
- npm: 8.12.2
- Node.js: 16.15.1
- OS Name: Ubuntu
- npm config: none
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.