npm / npm/cli

[BUG] npm 8 allows incorrect peer dependencies when upgrading a v1 lockfile to v2.

Open
#5,051 3 comments 0 reactions 1 assignee View on GitHub

@siemhesda is already working on this.

Since Dec 13, 2023.

Bug Priority 1 Release 8.x
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
This issue exists in the latest npm version
  • I am using the latest npm
Current Behavior

When npm 8 installs from a v1 lockfile it does not error on incorrect peer dependencies. It doesn't print any peer dependency warnings and exits successfully.

Expected Behavior

I expect npm 8 to error on invalid peer dependencies.

Steps To Reproduce
  1. Create a npm package with incorrect peer dependencies. ts-node depends on typescript@>=2.7, I choose this arbitrarily.
{
  "dependencies": {
    "typescript": "1.8.0",
    "ts-node": "9.1.1"
  }
}
  1. Run npm 6 install to create a v1 lockfile.
$ npx npm@6 install
npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN ts-node@9.1.1 requires a peer of typescript@>=2.7 but none is installed. You must install peer dependencies yourself.

added 10 packages from 44 contributors in 2.371s

exit 0

  1. run npm 8 (8.12.2 at time of writing) to update to a v2 lockfile.
$ npx npm@8 install
npm WARN old lockfile
npm WARN old lockfile The package-lock.json file was created with an old version of npm,
npm WARN old lockfile so supplemental metadata must be fetched from the registry.
npm WARN old lockfile
npm WARN old lockfile This is a one-time fix-up, please be patient...
npm WARN old lockfile

up to date in 2s

exit 0.

This is unexpected. I expect npm 8 to error on incorrect peer dependencies. A subsequent install will error

$ npx npm@8 install
npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve

exit 1

Environment
  • npm: 8.12.2
  • Node.js: 16.15.1
  • OS Name: Ubuntu
  • npm config: none

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.