[BUG] npm install does not output an error, but dependencies' dependencies are unmet

[bhallstein]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

npm install fails to install dependencies of dependencies.

Expected Behavior

Either npm install should warn or error when it cannot meet dependencies in the tree, or npm install should successfully resolve and install the dependencies.

Steps To Reproduce

{
  "name": "npm-install-issue",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "",
  "license": "ISC",
  "dependencies": {
    "@apollo/client": "^3.3.19",
    "otter-editor": "^0.0.100"
  }
}

With above package.json, run npm install, then npm list --all, which shows several unmet dependencies. On my machine:

npm-install-issue:$ n list --all
npm-install-issue@1.0.0 /Users/ben/Desktop/npm-install-issue
├─┬ @apollo/client@3.3.19
│ ├── UNMET DEPENDENCY @graphql-typed-document-node/core@^3.0.0
│ ├── @types/zen-observable@0.8.2
│ ├─┬ @wry/context@0.6.0
│ │ └── tslib@2.2.0
│ ├─┬ @wry/equality@0.4.0
│ │ └── tslib@2.2.0
│ ├── fast-json-stable-stringify@2.1.0
│ ├── UNMET DEPENDENCY graphql-tag@^2.12.0
│ ├── UNMET DEPENDENCY graphql@^14.0.0 || ^15.0.0
│ ├─┬ hoist-non-react-statics@3.3.2
│ │ └── react-is@16.13.1
│ ├─┬ optimism@0.16.1
│ │ ├── @wry/context@0.6.0 deduped
│ │ └─┬ @wry/trie@0.3.0
│ │   └── tslib@2.2.0
│ ├─┬ prop-types@15.7.2
│ │ ├─┬ loose-envify@1.4.0
│ │ │ └── js-tokens@4.0.0
│ │ ├── object-assign@4.1.1
│ │ └── react-is@16.13.1 deduped
│ ├─┬ react@17.0.2
│ │ ├── loose-envify@1.4.0 deduped
│ │ └── object-assign@4.1.1 deduped
│ ├── UNMET OPTIONAL DEPENDENCY subscriptions-transport-ws@^0.9.0
│ ├── symbol-observable@2.0.3
│ ├─┬ ts-invariant@0.7.3
│ │ └── tslib@2.2.0
│ ├── tslib@1.14.1
│ └── zen-observable@0.8.15
└─┬ otter-editor@0.0.100
  ├── UNMET DEPENDENCY @heroicons/react@^1.0.1
  ├── UNMET DEPENDENCY react-beautiful-dnd@^13.1.0
  ├─┬ react-dom@17.0.2
  │ ├── loose-envify@1.4.0 deduped
  │ ├── object-assign@4.1.1 deduped
  │ ├── react@17.0.2 deduped
  │ └─┬ scheduler@0.20.2
  │   ├── loose-envify@1.4.0 deduped
  │   └── object-assign@4.1.1 deduped
  ├── UNMET DEPENDENCY react-quill@^1.3.5
  ├─┬ react-toggle@4.1.2
  │ ├── classnames@2.3.1
  │ ├── prop-types@15.7.2 deduped
  │ ├── react-dom@17.0.2 deduped
  │ └── react@17.0.2 deduped
  └── react@17.0.2 deduped

npm ERR! code ELSPROBLEMS
npm ERR! missing: @graphql-typed-document-node/core@^3.0.0, required by @apollo/client@3.3.19
npm ERR! missing: graphql-tag@^2.12.0, required by @apollo/client@3.3.19
npm ERR! missing: graphql@^14.0.0 || ^15.0.0, required by @apollo/client@3.3.19
npm ERR! missing: @heroicons/react@^1.0.1, required by otter-editor@0.0.100
npm ERR! missing: react-beautiful-dnd@^13.1.0, required by otter-editor@0.0.100
npm ERR! missing: react-quill@^1.3.5, required by otter-editor@0.0.100

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/ben/.npm/_logs/2021-06-07T13_52_14_749Z-debug.log

Environment

• OS: macOS Big Sur v11.4
• Node: 16.3.0
• npm: 7.16.0

[bhallstein]

Above is on npm 7.16.0. The most recent previous version of npm I was able to install on which npm install produces the expected errors was 7.11.1:

$ npm install
npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! Found: react@17.0.2
npm ERR! node_modules/react
npm ERR!   peerOptional react@"^16.8.0 || ^17.0.0" from @apollo/client@3.3.19
npm ERR!   node_modules/@apollo/client
npm ERR!     @apollo/client@"^3.3.17" from the root project
npm ERR!   peer react@">=16" from @headlessui/react@1.2.0
npm ERR!   node_modules/@headlessui/react
npm ERR!     @headlessui/react@"^1.2.0" from the root project
npm ERR!   7 more (@heroicons/react, @icons/material, otter-editor, ...)
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer react@"^0.14.9 || ^15.3.0 || ^16.0.0" from react-quill@1.3.5
npm ERR! node_modules/otter-editor/node_modules/react-quill
npm ERR!   react-quill@"^1.3.5" from otter-editor@0.0.100
npm ERR!   node_modules/otter-editor
npm ERR!     otter-editor@"^0.0.100" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /Users/ben/.npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/ben/.npm/_logs/2021-06-07T14_00_14_217Z-debug.log
app:$ n --version
7.11.1

I then tried 7.12.0 and npm install succeeded without errors but npm list --all shows missing deps as in the reported issue.

[ljharb]

In that last output, the issue is that react-quill is not compatible with react 17, but you have react 17 installed. You'll have to downgrade to react 16, upgrade to a version of react-quill that supports react 17, or drop react-quill - otherwise your dep graph will be invalid.

[bhallstein]

Hi, thanks for your reply!

Sorry if I wasn't clear. I purposefully chose the above deps to produce a set of dependencies that ought to create an error, the error you describe.

The issue is about npm install — specifically that npm install does not throw an error or warning where it should be doing so (and did so in previous versions of npm).

Edit: I've just amended the issue title, the one I wrote initially was a bit misleading. Sorry about that.

[isaacs]

Thanks for the reproducible test case! This was broken on npm/arborist@e4a5fd2. Digging into this shortly.

[isaacs]

Reduced dep set that will trigger the issue:

{
  "dependencies": {
    "react-beautiful-dnd": "^13.1.0",
    "react-quill": "1.3.5"
  }
}

Relevant/simplified dep graph bits that we care about (for reducing further):

react-beautiful-dnd -> PEER(react@16||17, react-dom@16||17, use-memo-one)
use-memo-one -> PEER(react@16||17)
react-dom@16 -> PEER(react@16)
react-dom@17 -> PEER(react@17)
react-quill -> PEER(react@16)

So what's happening here (as of npm/arborist@e4a5fd2) is that we're placing all the deps for react-beautiful-dnd successfully, landing on react@17, because that's the latest and greatest.

Then, we evaluate react-quill, which needs react@16, but there are other deps outside if react-quill's peer set that depend on react@17.

The change in npm/arborist@e4a5fd2 is intending to identify whether a conflicting peer set can be clobbered and re-evaluated, if all of the deps could be either satisfied by the new set, or clobbered and moved deeper in the tree. Apparently it's deciding to clobber, but not re-evaluating properly.

[isaacs]

This is fixed in @npmcli/arborist@2.8.0, which will be in the next npm cli release.

[bhallstein]

Great news! Thanks very much for giving this your attention.