Peer dependencies not installed (inconsistent with modern npm)

[cefn]

Describe the bug

I was experimenting with running an app from github like this...

https://stackblitz.com/github/cefn/watchable/tree/80692ad0ec8a8ae11b90ed8ea5892e3535014f7e/apps/counter-dom-js?file=README.md

Unfortunately, the behaviour of stackblitz with respect to peerDependencies of dependencies seems to be non-standard.

In this commit the referenced version of @lauf/store-follow has a peer dependency of @lauf/queue declared but @lauf/queue was not installed leading to a failure of the app.

By contrast downloading that folder and running npm install && npm run dev DOES install @lauf/queue as expected by npm standards since npm 7.

A workaround for stackblitz is to fork the app and manually add the proper version of @lauf/queue which DOES then work.

Link to the blitz that caused the error

https://stackblitz.com/github/cefn/watchable/tree/alpha-release/apps/counter-dom-js?file=package.json

Steps to reproduce

Visit https://stackblitz.com/github/cefn/watchable/tree/80692ad0ec8a8ae11b90ed8ea5892e3535014f7e/apps/counter-dom-js?file=README.md
and observe failure.

Expected behavior

The peerDependencies of dependencies ARE installed and the app does not fail.

Parity with Local

• I have run the project in my local machine and I could not reproduce the issue.

Screenshots

No response

Platform

Browser name  = Chrome
Full version  = 109.0.0.0
Major version = 109
navigator.appName = Netscape
navigator.userAgent = Mozilla/5.0 (X11; CrOS x86_64 15236.80.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
performance.memory = {
  "totalJSHeapSize": 83182259,
  "usedJSHeapSize": 53512071,
  "jsHeapSizeLimit": 2172649472
}
Hash = 9926f97d

Additional context

No response

[cefn]

Note the following...

UPDATE: npm versions 1, 2, and 7 will automatically install peerDependencies if they are not explicitly depended upon higher in the dependency tree. For npm versions 3 through 6, you will receive a warning that the peerDependency is not installed instead.

https://nodejs.org/en/blog/npm/peer-dependencies

which suggests that either showing a warning OR providing the dependency is required by every version of NPM, with the modern versions - post 7 doing an actual install of peerDependencies.

[cefn]

As a workaround I'm going to follow the guidance of npm/rfcs#324 which seems supported since 7.5.5 meaning my package will (in npm) install a hard dependency if its peer dependency is not satisfied.

This will also act as a workaround for non-standard handling of peerDependencies. However it comes at the cost of duplicates, which may lead to real bugs when projects are run in Stackblitz and (duplicate) dependencies are installed when they should be (deduped) peer dependencies. See https://nodejs.org/api/packages.html#dual-package-hazard.

[Nemikolh]

Hi @cefn ! Thanks for the report.

We are planning to release native npm support which should solve most of your issues. Right now, npm is an alias to turbo our custom package manager and it works a bit differently.

We'll keep you posted.

[jrvidal]

Closing as duplicate of #1070, you can track progress there!