[BUG] peerDependencies resolve only latest versions ignoring semver compatibility with other peer deps
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
We are installing (without --legacy-peer-deps flag) parent module, who wants dependencies child-peer and child-dep. Child-peer has peerDependency for history >=4, child-dep has dependency for history ^4.
npm resolves in the root node_modules 5th major of history, but semver allows us to get 4th major and install it only once for all of them instead installing 5th for root and child-peer; 4th for child-dep.
It is separated behavior for docs advice to make deps versions as broad as possible.
Resolved tree:
└- [parent] history: 5.3.0
└- [child-dep] history: 4.10.1
Dependencies tree:
└- [child-peer] history: devDependencies ^4
└- [child-peer] history: peerDependencies >=4
└- [child-dep] history: dependencies ^4
└- [child-dep] history: peerDependencies ^4
Expected Behavior
Resolved tree:
└- [parent] history: 4.10.1
Dependencies tree:
└- [child-peer] history: devDependencies ^4
└- [child-peer] history: peerDependencies >=4
└- [child-dep] history: dependencies ^4
└- [child-dep] history: peerDependencies ^4
Steps To Reproduce
We have these package.json:
- parent:
{ "name": "parent", "version": "0.0.1", "dependencies": { "child-peer": "0.0.1", "child-dep": "0.0.1" } } - child-dep:
{ "name": "child-dep", "version": "0.0.1", "dependencies": { "history": "^4" }, "peerDependencies": { "history": "^4" } } - child-peer:
{ "name": "child-peer", "version": "0.0.1", "peerDependencies": { "history": ">=4" }, "devDependencies": { "history": "^4" } }
Install parent. Look at parent/node_modules/history version. No 4th major, but 5th major.
Environment
- npm: 8.5.3
- Node.js: 16.14.0
- OS Name: macOS 12.4
- System Model Name: Macbook Pro
- npm config: Sorry, there is my own creds
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue using the parent, child-peer, and child-dep package.json fixtures and the npm 8.5.3 environment described. Compare the installed history version with the expected dependency tree; done means compatible history 4.x is resolved once without requiring --legacy-peer-deps.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- cli, devtools
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100