npm / npm/cli

[BUG] --legacy-peer-deps doesn't work if own package has no peerDependencies

Open
#6,262 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Needs Triage Release 8.x
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
This issue exists in the latest npm version
  • I am using the latest npm
Current Behavior

This issue was observed in both v8 and v9. The problem is as follows:
I have a package.json that includes some dependent packages that themselves have peerDependencies. When running npm i or npm ci, all peer dependencies of my own package as well as those of the dependent packages are installed as expected. When running npm i --legacy-peer-deps or npm ci --legacy-peer-deps no peer dependencies of my own package or those of the dependents are installed, with an exception: if my own package does not specify any peer dependecies itself then npm ci --legacy-peer-deps seem to ignore the --legacy-peer-deps flag and went ahead and install all the dependents' peer dependencies. This problem is not observed when my own package has at least one peer dependency.

Expected Behavior

If my own package.json has no peer dependency, but my dependent packages have peer dependencies, then npm ci --legacy-peer-deps should not install any peer dependency from those dependent packages.

Steps To Reproduce

Create an empty package.json then pull in a package with known peer dependencies, say react-native (which has one peer dependency: react), in the dependencies section (make sure your package.json has no peerDependencies, or empty peerDependencies).
Now run npm i. You should see all the peer dendencies packages installed in node_modules (in this case it's react).
Now run npm ci --legacy-peer-deps, you will see that all the peer dependencies packages (again react) are still installed in node_modules.
Now add a simple package in your own peerDependencies, say chai. Now run npm i, you should still see all the peer dependencies packages installed in node_modules. Now run npm ci --legacy-peer-deps, you should see all the peer dependencies packages (again in our case, react) removed from the node_modules as expected.

Environment
  • npm: 8.19.4
  • Node.js: 18.12.1
  • OS Name: CentOS 8
  • System Model Name: x86-64 VM (VMware)
  • npm config:

; "user" config from /localhome/haiv/.npmrc
...
; node bin location = /localhome/haiv/.nvm/versions/node/v18.12.1/bin/node
; node version = v18.12.1
; npm local prefix = /localhome/haiv/workspaces/npmtest
; npm version = 8.19.4
; cwd = /localhome/haiv/workspaces/npmtest
; HOME = /localhome/haiv
; Run `npm config ls -l` to show all defaults.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the package.json scenario described in the reproduction steps, using react-native as the dependency and testing npm ci with and without --legacy-peer-deps. Compare the resulting node_modules contents when the root package has no peerDependencies and when it includes chai; done means dependent peer dependencies are omitted in both legacy-peer-deps cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
cli, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.