From e4c26b779da7208ce309e749d1e7674fccb41ba8 Mon Sep 17 00:00:00 2001
From: Chris Olszewski <chris.olszewski@vercel.com>
Date: Fri, 5 May 2023 16:51:33 -0700
Subject: [PATCH] fix: no longer include peer dependencies in transitive
 closures (#4824)

### Description

Fixes #4757

Underlying issue was I was including `peerDependencies` in the
dependency crawl. This resulted in an error since we expect to only be
looking at external dependencies in the dependency crawl.

### Testing Instructions

Added a failing unit test where there's a workspace that's used as a
peer dependency that conflicts with a package in the registry.
---
 .../fixtures/workspace-peer-dependency.json   | 71 +++++++++++++++++++
 crates/turborepo-lockfiles/src/npm.rs         | 29 +++++++-
 2 files changed, 99 insertions(+), 1 deletion(-)
 create mode 100644 crates/turborepo-lockfiles/fixtures/workspace-peer-dependency.json

diff --git a/crates/turborepo-lockfiles/fixtures/workspace-peer-dependency.json b/crates/turborepo-lockfiles/fixtures/workspace-peer-dependency.json
new file mode 100644
index 0000000000000..24f5eea0a5fd9
--- /dev/null
+++ b/crates/turborepo-lockfiles/fixtures/workspace-peer-dependency.json
@@ -0,0 +1,71 @@
+{
+  "name": "npm-test",
+  "version": "1.0.0",
+  "lockfileVersion": 2,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "npm-test",
+      "version": "1.0.0",
+      "license": "ISC",
+      "workspaces": ["packages/**"]
+    },
+    "node_modules/a": {
+      "resolved": "packages/a",
+      "link": true
+    },
+    "node_modules/b": {
+      "resolved": "packages/b",
+      "link": true
+    },
+    "node_modules/eslint": {
+      "resolved": "packages/c",
+      "link": true
+    },
+    "node_modules/eslint-plugin-turbo": {
+      "version": "1.9.3",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-turbo/-/eslint-plugin-turbo-1.9.3.tgz",
+      "integrity": "sha512-ZsRtksdzk3v+z5/I/K4E50E4lfZ7oYmLX395gkrUMBz4/spJlYbr+GC8hP9oVNLj9s5Pvnm9rLv/zoj5PVYaVw==",
+      "peerDependencies": {
+        "eslint": ">6.6.0"
+      }
+    },
+    "packages/a": {
+      "dependencies": {
+        "eslint": "^0.0.0-workspace",
+        "eslint-plugin-turbo": "^1.9.3"
+      }
+    },
+    "packages/b": {
+      "peerDependencies": {
+        "eslint": "*"
+      }
+    },
+    "packages/c": {
+      "name": "eslint",
+      "version": "0.0.0-workspace"
+    }
+  },
+  "dependencies": {
+    "a": {
+      "version": "file:packages/a",
+      "requires": {
+        "eslint": "^0.0.0-workspace",
+        "eslint-plugin-turbo": "^1.9.3"
+      }
+    },
+    "b": {
+      "version": "file:packages/b",
+      "requires": {}
+    },
+    "eslint": {
+      "version": "file:packages/c"
+    },
+    "eslint-plugin-turbo": {
+      "version": "1.9.3",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-turbo/-/eslint-plugin-turbo-1.9.3.tgz",
+      "integrity": "sha512-ZsRtksdzk3v+z5/I/K4E50E4lfZ7oYmLX395gkrUMBz4/spJlYbr+GC8hP9oVNLj9s5Pvnm9rLv/zoj5PVYaVw==",
+      "requires": {}
+    }
+  }
+}
diff --git a/crates/turborepo-lockfiles/src/npm.rs b/crates/turborepo-lockfiles/src/npm.rs
index 37c4ec5398a2c..6374a11baf4c7 100644
--- a/crates/turborepo-lockfiles/src/npm.rs
+++ b/crates/turborepo-lockfiles/src/npm.rs
@@ -189,7 +189,6 @@ impl NpmPackage {
             .keys()
             .chain(self.dev_dependencies.keys())
             .chain(self.optional_dependencies.keys())
-            .chain(self.peer_dependencies.keys())
     }
 }
 
@@ -395,4 +394,32 @@ mod test {
         );
         Ok(())
     }
+
+    #[test]
+    fn test_workspace_peer_dependencies() -> Result<(), Error> {
+        let lockfile =
+            NpmLockfile::load(include_bytes!("../fixtures/workspace-peer-dependency.json"))?;
+        let closures = crate::all_transitive_closures(
+            &lockfile,
+            vec![
+                (
+                    "packages/a".into(),
+                    vec![("eslint-plugin-turbo".into(), "^1.9.3".into())]
+                        .into_iter()
+                        .collect(),
+                ),
+                ("packages/b".into(), HashMap::new()),
+                ("packages/c".into(), HashMap::new()),
+            ]
+            .into_iter()
+            .collect(),
+        )?;
+        assert!(closures.get("packages/a").unwrap().contains(&Package {
+            key: "node_modules/eslint-plugin-turbo".into(),
+            version: "1.9.3".into()
+        }));
+        assert!(closures.get("packages/b").unwrap().is_empty());
+        assert!(closures.get("packages/c").unwrap().is_empty());
+        Ok(())
+    }
 }