[BUG] --legacy-peer-deps doesn't work if own package has no peerDependencies
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
This issue was observed in both v8 and v9. The problem is as follows:
I have a package.json that includes some dependent packages that themselves have peerDependencies. When running npm i or npm ci, all peer dependencies of my own package as well as those of the dependent packages are installed as expected. When running npm i --legacy-peer-deps or npm ci --legacy-peer-deps no peer dependencies of my own package or those of the dependents are installed, with an exception: if my own package does not specify any peer dependecies itself then npm ci --legacy-peer-deps seem to ignore the --legacy-peer-deps flag and went ahead and install all the dependents' peer dependencies. This problem is not observed when my own package has at least one peer dependency.
Expected Behavior
If my own package.json has no peer dependency, but my dependent packages have peer dependencies, then npm ci --legacy-peer-deps should not install any peer dependency from those dependent packages.
Steps To Reproduce
Create an empty package.json then pull in a package with known peer dependencies, say react-native (which has one peer dependency: react), in the dependencies section (make sure your package.json has no peerDependencies, or empty peerDependencies).
Now run npm i. You should see all the peer dendencies packages installed in node_modules (in this case it's react).
Now run npm ci --legacy-peer-deps, you will see that all the peer dependencies packages (again react) are still installed in node_modules.
Now add a simple package in your own peerDependencies, say chai. Now run npm i, you should still see all the peer dependencies packages installed in node_modules. Now run npm ci --legacy-peer-deps, you should see all the peer dependencies packages (again in our case, react) removed from the node_modules as expected.
Environment
- npm: 8.19.4
- Node.js: 18.12.1
- OS Name: CentOS 8
- System Model Name: x86-64 VM (VMware)
- npm config:
; "user" config from /localhome/haiv/.npmrc
...
; node bin location = /localhome/haiv/.nvm/versions/node/v18.12.1/bin/node
; node version = v18.12.1
; npm local prefix = /localhome/haiv/workspaces/npmtest
; npm version = 8.19.4
; cwd = /localhome/haiv/workspaces/npmtest
; HOME = /localhome/haiv
; Run `npm config ls -l` to show all defaults.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the package.json scenario described in the reproduction steps, using react-native as the dependency and testing npm ci with and without --legacy-peer-deps. Compare the resulting node_modules contents when the root package has no peerDependencies and when it includes chai; done means dependent peer dependencies are omitted in both legacy-peer-deps cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- cli, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100