You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The design goal of this is to provide a dependency version specified by us, but allow it to be overridden by peerDependency in client projects if their installed version is greater than ours. Looking at this RFC that was closed as completed, it seems like this is meant to work in npm. However, both versions are currently installed. Here is an example repo demonstrating the current behavior: https://github.com/quantizor/styled-components-repro
I did an analysis of other package managers like yarn and pnpm, and they both seem to honor peerDependencies as an override over dependencies if both are specified in a library being consumed by a client application.
You can see this in action for the supplied reproduction repository by following these instructions after cloning:
Delete node_modules and package-lock.json
Run yarn install
Observe in node_modules/styled-components that no extra node_modules folder is added
What is the expected behavior?
If a package declared in both dependencies and peerDependencies, peerDependencies should "win" if a compliant higher version is installed in the client application.
What do you see instead?
postcss is installed in root node_modules and also in node_modules/styled-components/node_modules. There should only be the root version which is one patch release higher than that is specified in node_modules/styled-components/package.json.
Observe that node_modules/styled-components/node_modules has a duplicated module for postcss (there is a higher version also installed at node_modules/postcss)
The text was updated successfully, but these errors were encountered:
What version of Bun is running?
1.0.20
What platform is your computer?
macOS
What steps can reproduce the bug?
This bug affects npm as well, but not yarn or pnpm.
Given the following config:
The design goal of this is to provide a dependency version specified by us, but allow it to be overridden by peerDependency in client projects if their installed version is greater than ours. Looking at this RFC that was closed as completed, it seems like this is meant to work in npm. However, both versions are currently installed. Here is an example repo demonstrating the current behavior: https://github.com/quantizor/styled-components-repro
I did an analysis of other package managers like yarn and pnpm, and they both seem to honor
peerDependencies
as an override overdependencies
if both are specified in a library being consumed by a client application.You can see this in action for the supplied reproduction repository by following these instructions after cloning:
node_modules
andpackage-lock.json
yarn install
node_modules/styled-components
that no extranode_modules
folder is addedWhat is the expected behavior?
If a package declared in both
dependencies
andpeerDependencies
,peerDependencies
should "win" if a compliant higher version is installed in the client application.What do you see instead?
postcss
is installed in rootnode_modules
and also innode_modules/styled-components/node_modules
. There should only be the root version which is one patch release higher than that is specified innode_modules/styled-components/package.json
.Additional information
cd
into the directorypackage-lock.json
andnode_modules
bun install
node_modules/styled-components/node_modules
has a duplicated module forpostcss
(there is a higher version also installed atnode_modules/postcss
)The text was updated successfully, but these errors were encountered: