Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove peerDependencies to avoid auto-install on npm 7 #4480

Merged
merged 1 commit into from
May 11, 2021
Merged

Conversation

kibertoad
Copy link
Collaborator

fixes #4437

@kibertoad kibertoad merged commit e616a8a into master May 11, 2021
@kibertoad kibertoad deleted the fix/npm-7 branch May 11, 2021 20:33
@B4nan
Copy link

B4nan commented May 12, 2021

This seems wrong to me, NPM 7 should actually respect peerDependenciesMeta, but without the real peerDependencies I don't think it has any meaning.

https://docs.npmjs.com/cli/v7/configuring-npm/package-json#peerdependenciesmeta

I'd expect that doing this might result in wrong dependency resolutions (the peer deps won't be considered as peer deps). In other words, I'd expect things like yarn pnp to be broken as knex should not see those dependencies at all under strict environments. cc @merceyz maybe I got it wrong or I missed something.

@kibertoad
Copy link
Collaborator Author

@B4nan Marking a peer dependency as optional ensures npm will not emit a warning if the soy-milk package is not installed on the host.

Does it actually prevent npm7 from autoinstalling the dependency, though?

https://betterprogramming.pub/the-step-by-step-guide-to-understanding-and-adopting-npm-7-914504f7090f says nothing about respecting the meta.

@B4nan
Copy link

B4nan commented May 12, 2021

I believe it does, see npm/rfcs#289

peerOptional deps are deps that are listed in peerDependencies and also have an entry in peerDependenciesMeta containing {"optional": true}. These sorts of dependencies are not installed by default, but if installed, must be resolved to a version that satisfies the optional peer dependency relationship.

@kibertoad
Copy link
Collaborator Author

@B4nan thanks, I'll gve it a test today and will release a hotfix.

@merceyz
Copy link

merceyz commented May 12, 2021

I'd expect that doing this might result in wrong dependency resolutions (the peer deps won't be considered as peer deps). In other words, I'd expect things like yarn pnp to be broken as knex should not see those dependencies at all under strict environments. cc @merceyz maybe I got it wrong or I missed something.

Yarn treats peerDependenciesMeta.<name>.optional: true as an implicit peerDependencies.<name>: "*" if one isn't specified https://github.com/yarnpkg/berry/blob/0f7644f6d9cd219b532816ab6250f6cb63426486/packages/yarnpkg-core/sources/Configuration.ts#L1533-L1543

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

remove peerDependencies and keep peerDependenciesMeta only.
3 participants