npm / npm/cli

[BUG] peerDependencies resolve only latest versions ignoring semver compatibility with other peer deps

Open
#5,305 5 comments 9 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Needs Triage Release 8.x
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
This issue exists in the latest npm version
  • I am using the latest npm
Current Behavior

We are installing (without --legacy-peer-deps flag) parent module, who wants dependencies child-peer and child-dep. Child-peer has peerDependency for history >=4, child-dep has dependency for history ^4.
npm resolves in the root node_modules 5th major of history, but semver allows us to get 4th major and install it only once for all of them instead installing 5th for root and child-peer; 4th for child-dep.

It is separated behavior for docs advice to make deps versions as broad as possible.

Resolved tree:
└- [parent] history: 5.3.0
└- [child-dep] history: 4.10.1

Dependencies tree:
└- [child-peer] history: devDependencies ^4
└- [child-peer] history: peerDependencies >=4
└- [child-dep] history: dependencies ^4
└- [child-dep] history: peerDependencies ^4

Expected Behavior

Resolved tree:
└- [parent] history: 4.10.1

Dependencies tree:
└- [child-peer] history: devDependencies ^4
└- [child-peer] history: peerDependencies >=4
└- [child-dep] history: dependencies ^4
└- [child-dep] history: peerDependencies ^4

Steps To Reproduce

We have these package.json:

  • parent:
    { "name": "parent", "version": "0.0.1", "dependencies": { "child-peer": "0.0.1", "child-dep": "0.0.1" } }
  • child-dep:
    { "name": "child-dep", "version": "0.0.1", "dependencies": { "history": "^4" }, "peerDependencies": { "history": "^4" } }
  • child-peer:
    { "name": "child-peer", "version": "0.0.1", "peerDependencies": { "history": ">=4" }, "devDependencies": { "history": "^4" } }

Install parent. Look at parent/node_modules/history version. No 4th major, but 5th major.

Environment
  • npm: 8.5.3
  • Node.js: 16.14.0
  • OS Name: macOS 12.4
  • System Model Name: Macbook Pro
  • npm config: Sorry, there is my own creds

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue using the parent, child-peer, and child-dep package.json fixtures and the npm 8.5.3 environment described. Compare the installed history version with the expected dependency tree; done means compatible history 4.x is resolved once without requiring --legacy-peer-deps.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
cli, devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.