fix: corrects peer dependency flag propagation by owlstronaut · Pull Request #8579 · npm/cli

owlstronaut · 2025-09-17T19:31:01Z

Summary

Fixes peer dependency flag propagation in npm's dependency resolution system by correcting how "peer": true flags are calculated and applied.

Problem

Peer dependency flags were inconsistently and incorrectly calculated, leading to incorrect or missing "peer": true flags in the ideal tree, which could cause dependency resolution issues.

#8431 revealed a number of bugs, the worst of which appears to be that many packages in an ideal tree were marked peer when they shouldn't have been. If they were also optional, they were being removed by this pruning. This is my attempt to make a forward-fix instead of revert the aforementioned correct but also (through no fault of its own) disruptive PR #8431 .

This doesn't solve the problem of legitimate peerOptionals being uninstallable even with npm i <peer-optional-package>. It both makes sense for that to be pruned, but also for people that do it to have it either install or warn them. Right now it silently moves along. We could allow it to not be pruned that 1 time by using explicitRequests, but would subsequently be pruned on further installs.

Related:
#8464
#8431
#8489

owlstronaut · 2025-09-17T21:49:53Z

@G-Rath @jenseng Would love your take on this if you find time. I'm attempting to fix-foreward rather than revert, but this stuff is pretty meaty.

jenseng · 2025-09-17T21:57:33Z

@owlstronaut I've confirmed that this fixes my simple repro here ... npm install succeeds, and the lockfile no longer marks those deps as "peer": true 🥳

jenseng · 2025-09-17T22:03:44Z

The fix also works in our internal repos whose installs failed under npm@11.5.x 🚀

wraithgar · 2025-09-18T16:19:04Z

Thank you so much for reviewing this @jenseng it really helps when folks with domain knowledge do this.

workspaces/arborist/lib/calc-dep-flags.js

wraithgar · 2025-09-19T00:54:04Z

package-lock.json

      "integrity": "sha512-UlLAnTPrFdNGoFtbSXwcGFQBtQZJCNjaN6hQNP3UPvuNXT1i82N26KL3dZeIpNalWywr9IuQuncaAfUaS1g6sQ==",
      "dev": true,
      "license": "MIT",
+      "peer": true,


Just wanted to double check some of these and the very first one is good. This is being correctly flagged as a peer, from npm explain @babel/core@7.28.0:

peer @babel/core@"^7.0.0" from @babel/helper-module-transforms@7.27.3

- reverts pruning added in #8431, which incorrectly prunes deps flagged as `peer` and `optional` - these flags don't mean that this node is an optional peer! - reverts much of #8579, which I think mistakenly changed peer dep calculation logic - rewrites calcDepFlags - adds logic to avoid unsetting `extraneous` when following optional peer edges (how #8431, should have been fixed) - updates my prev fix to avoid looking for missing optional peer deps (`if ((!edge.to && edge.type !== 'peerOptional') || !edge.valid) {`) - refactors dep flag unsetting and resetting into Node methods - removes `shake out Link target timing issue` test, which was testing code [removed](2db6c08#diff-6778dbd4bbfddaeb827a8d2aa7248d4c9b329229f69e407d5fd487abe16dd942L333) a while back - avoids omitting flaky`selflink` fixture when writing snapshots Fixes #8535

...GitHub utilise désormais la nouvelle version de node (24.11.1) et npm (11.6.2) qui introduit une correction dans la résolution des dépendances. (npm/cli#8579) Cette correction a introduit un bug dans notre installation de dépendances (avec @parcel/watcher non trouvé).

This release corrects the peer dependency flag propagation. See https://docs.npmjs.com/cli/v11/using-npm/changelog#1161-2025-09-23 and npm/cli#8579

…ectories with 4 updates (#91) * Bump the minor-updates group across 2 directories with 4 updates Bumps the minor-updates group with 4 updates in the / directory: [hmrc-frontend](https://github.com/hmrc/hmrc-frontend), [openai](https://github.com/openai/openai-node), [prettier](https://github.com/prettier/prettier) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint). Bumps the minor-updates group with 1 update in the /data/zip-download directory: [hmrc-frontend](https://github.com/hmrc/hmrc-frontend). Updates `hmrc-frontend` from 6.100.0 to 6.103.0 - [Release notes](https://github.com/hmrc/hmrc-frontend/releases) - [Changelog](https://github.com/hmrc/hmrc-frontend/blob/main/CHANGELOG.md) - [Commits](hmrc/hmrc-frontend@v6.100.0...v6.103.0) Updates `openai` from 6.8.1 to 6.9.1 - [Release notes](https://github.com/openai/openai-node/releases) - [Changelog](https://github.com/openai/openai-node/blob/master/CHANGELOG.md) - [Commits](openai/openai-node@v6.8.1...v6.9.1) Updates `prettier` from 3.6.2 to 3.7.0 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.6.2...3.7.0) Updates `typescript-eslint` from 8.46.0 to 8.48.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.48.0/packages/typescript-eslint) Updates `hmrc-frontend` from 6.100.0 to 6.103.0 - [Release notes](https://github.com/hmrc/hmrc-frontend/releases) - [Changelog](https://github.com/hmrc/hmrc-frontend/blob/main/CHANGELOG.md) - [Commits](hmrc/hmrc-frontend@v6.100.0...v6.103.0) Updates `hmrc-frontend` from 6.100.0 to 6.103.0 - [Release notes](https://github.com/hmrc/hmrc-frontend/releases) - [Changelog](https://github.com/hmrc/hmrc-frontend/blob/main/CHANGELOG.md) - [Commits](hmrc/hmrc-frontend@v6.100.0...v6.103.0) Updates `hmrc-frontend` from 6.100.0 to 6.103.0 - [Release notes](https://github.com/hmrc/hmrc-frontend/releases) - [Changelog](https://github.com/hmrc/hmrc-frontend/blob/main/CHANGELOG.md) - [Commits](hmrc/hmrc-frontend@v6.100.0...v6.103.0) --- updated-dependencies: - dependency-name: hmrc-frontend dependency-version: 6.103.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-updates - dependency-name: openai dependency-version: 6.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-updates - dependency-name: prettier dependency-version: 3.7.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-updates - dependency-name: typescript-eslint dependency-version: 8.48.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-updates - dependency-name: hmrc-frontend dependency-version: 6.103.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-updates - dependency-name: hmrc-frontend dependency-version: 6.103.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-updates - dependency-name: hmrc-frontend dependency-version: 6.103.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-updates ... Signed-off-by: dependabot[bot] <support@github.com> * Update ESLint config See https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.46.4 and typescript-eslint/typescript-eslint#11333 * Set npm version to v11.6.1 This release corrects the peer dependency flag propagation. See https://docs.npmjs.com/cli/v11/using-npm/changelog#1161-2025-09-23 and npm/cli#8579 * Upgrade npm to v11.6.1 in code-quality.yml --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Christopher Menon <16004217+cmenon12@users.noreply.github.com>

We've recently updated to Node 24, using at least npm v11.6.0. In npm v11.6.1, there was some work to improve the tagging of dependencies with `"peer": true`. npm/cli#8579 This PR updates our package-lock.json file to reflect these changes by running: 1. `nvm use` 2. `npm install`

There was a bug in npm v11.6.0 and prior that would mark dependencies as peer dependencies incorrectly (see npm/cli#8579). This was fixed in v11.6.1 (see the [npm changelog], but it seems that at some point our package lockfile was updated with incorrectly marked peer dependencies, and now when we run `npm install` on our machines with the latest version of npm it updates the package lockfile to remove the marks, leading to noise in git. This commit updates the package lockfile with the (hopefully) correct peer dependency marks. I don't think we need to worry about Dependabot changing things back, as looking at the logs of a [recent Dependabot run] it looks like that is now using npm v11.6.2. [npm changelog]: https://github.com/npm/cli/blob/latest/CHANGELOG.md#1161-2025-09-23 [recent Dependabot run]: https://github.com/alphagov/forms-runner/actions/runs/20049289324/job/57501554830

owlstronaut force-pushed the owlstronaut/fix-peer-flag-calc branch 4 times, most recently from 90d9c5e to bcd771f Compare September 17, 2025 21:13

owlstronaut marked this pull request as ready for review September 17, 2025 21:48

owlstronaut requested a review from a team as a code owner September 17, 2025 21:48

wraithgar self-assigned this Sep 18, 2025

wraithgar reviewed Sep 18, 2025

View reviewed changes

workspaces/arborist/lib/calc-dep-flags.js Show resolved Hide resolved

wraithgar reviewed Sep 18, 2025

View reviewed changes

workspaces/arborist/lib/calc-dep-flags.js Outdated Show resolved Hide resolved

wraithgar reviewed Sep 18, 2025

View reviewed changes

workspaces/arborist/lib/calc-dep-flags.js Outdated Show resolved Hide resolved

wraithgar reviewed Sep 18, 2025

View reviewed changes

workspaces/arborist/lib/calc-dep-flags.js Outdated Show resolved Hide resolved

fix: corrects peer dependency flag propagation

cb986c5

owlstronaut force-pushed the owlstronaut/fix-peer-flag-calc branch from 6623b75 to cb986c5 Compare September 18, 2025 22:10

wraithgar reviewed Sep 19, 2025

View reviewed changes

wraithgar approved these changes Sep 19, 2025

View reviewed changes

This was referenced Sep 19, 2025

fix: prune optional peer dependencies that are no longer explicitly depended on #8431

Merged

fix: calculate omit in diff #8566

Merged

owlstronaut merged commit d389614 into latest Sep 19, 2025
33 checks passed

owlstronaut deleted the owlstronaut/fix-peer-flag-calc branch September 19, 2025 16:10

github-actions bot mentioned this pull request Sep 19, 2025

chore: release 11.6.1 #8571

Merged

npm-cli-bot mentioned this pull request Sep 25, 2025

deps: upgrade npm to 11.6.1 nodejs/node#60012

Merged

AviVahl mentioned this pull request Sep 27, 2025

[BUG] npm install produces different results on first and second run #8535

Closed

2 tasks

dynamictulip mentioned this pull request Sep 28, 2025

[BUG] npm install creates unsync package-lock.json #6787

Open

2 tasks

torokati44 mentioned this pull request Sep 30, 2025

web: Add 'peer: true' to some dependencies ruffle-rs/ruffle#21801

Merged

broksonic21 mentioned this pull request Sep 30, 2025

Add support for NPM v11 dependabot/dependabot-core#13158

Closed

1 task

marcustyphoon mentioned this pull request Oct 1, 2025

chore(deps): update dev dependencies AprilSylph/XKit-Rewritten#1891

Merged

1 task

liamcmitchell mentioned this pull request Oct 5, 2025

fix: dep flag calculation #8645

Merged

TrevorBurnham mentioned this pull request Oct 5, 2025

[EPIC]: Fix incorrect ERESOLVE errors from peer dependencies #8647

Closed

oleksandr-danylchenko mentioned this pull request Oct 6, 2025

Rehashed lockfile with fixed npm@11.6.1 recogito/text-annotator-js#228

Merged

LitoMore mentioned this pull request Oct 17, 2025

Update npm lockfile simple-icons/simple-icons#13901

Merged

mctylr-gh mentioned this pull request Oct 17, 2025

CODEBASE: Minor React related packages update bitburner-official/bitburner-src#2353

Merged

This was referenced Oct 18, 2025

Update npm lockfile simple-icons/simple-icons-font#248

Merged

Update npm lockfile simple-icons/svglint#138

Merged

pplancq mentioned this pull request Oct 30, 2025

chore(design-system): define node engines and use it in setup node action AxaFrance/design-system#1542

Draft

mgermerie mentioned this pull request Nov 4, 2025

[Chores] Update node supported version to 24 iTowns/itowns#2628

Merged

LitoMore mentioned this pull request Nov 16, 2025

Allow to run on Node.js 24 badges/shields#11505

Merged

fbezagu mentioned this pull request Nov 17, 2025

[CI] Corrige les dépendances pour Node 24.11 betagouv/anssi-demain-specialiste-cyber#334

Merged

felixweinberger mentioned this pull request Nov 20, 2025

Bump version to 1.23.0-beta.0 modelcontextprotocol/typescript-sdk#1147

Merged

cmenon12 added a commit to Capgemini/gov-prototype-by-prompt that referenced this pull request Nov 27, 2025

Set npm version to v11.6.1

4d96ea7

This release corrects the peer dependency flag propagation. See https://docs.npmjs.com/cli/v11/using-npm/changelog#1161-2025-09-23 and npm/cli#8579

This was referenced Dec 1, 2025

Add engines mozilla/bedrock#16906

Closed

Pin npm and node versions to ensure consistent updates with dependabot mozmeao/springfield#808

Closed

domoscargin mentioned this pull request Dec 8, 2025

Update package-lock.json alphagov/govuk-design-system#5033

Merged

lfdebrux mentioned this pull request Dec 11, 2025

Fix npm package lockfile alphagov/forms-runner#1787

Merged

lfdebrux mentioned this pull request Dec 11, 2025

Fix npm package lockfile alphagov/forms-admin#2429

Merged

lfdebrux mentioned this pull request Dec 11, 2025

Fix npm package lockfile alphagov/forms-product-page#990

Merged

phad mentioned this pull request Dec 17, 2025

DCMAW-16862: enable info logging in biometric-credential package govuk-one-login/mobile-id-check-async#955

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: corrects peer dependency flag propagation#8579

fix: corrects peer dependency flag propagation#8579
owlstronaut merged 1 commit intolatestfrom
owlstronaut/fix-peer-flag-calc

owlstronaut commented Sep 17, 2025 •

edited

Loading

Uh oh!

owlstronaut commented Sep 17, 2025

Uh oh!

jenseng commented Sep 17, 2025

Uh oh!

jenseng commented Sep 17, 2025 •

edited

Loading

Uh oh!

wraithgar commented Sep 18, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wraithgar Sep 19, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

owlstronaut commented Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem

Uh oh!

owlstronaut commented Sep 17, 2025

Uh oh!

jenseng commented Sep 17, 2025

Uh oh!

jenseng commented Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wraithgar commented Sep 18, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wraithgar Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

owlstronaut commented Sep 17, 2025 •

edited

Loading

jenseng commented Sep 17, 2025 •

edited

Loading

wraithgar Sep 19, 2025 •

edited

Loading