5 ms·

Pnpm doesn't auto install peer dependencies, which is annoying and forces you to unnecessary add them to package.json. Npm@7 (and newer) with auto install of pe

Pnpm doesn't auto install peer dependencies, which is annoying and forces you to unnecessary add them to package.json. Npm@7 (and newer) with auto install of peer deps is much easier to use in this regard.

ricardobeat 5y ago
Isn't that exactly how it's supposed to be? If you're installing a package that has peer dependencies, you should already depend on them. Otherwise they are not "peer dependencies" anymore, just a normal dependency with a version range. The whole peer dependencies story is another clusterfuck. Everyone simply ignored the invalid peer dependency warnings, and now npm itself will just install all of them in 'whatever works' version. To get real peer dependency resolution you need a --strict-peer-deps flag. Not exactly a "feature" in my book.
- Wronnay 5y ago
  Yeah - this peer dependency thing always makes issues, when I try to upgrade a big Ionic project... Peer dependencies added more problems than they solved in my eyes... Most peer dependencies warnings come because some maintainer forgot to update the package.json and not really because two packages don't work with each other...
  - eyelidlessness 5y ago
    The point of peer dependencies is to allow users more flexibility in choosing the specific version of the dependency. It’s not intended to specify any kind of conflict between the packages, it’s effectively BYO sub-dependency.
    - jrochkind1 5y ago
      regular traditional dependencies can already be specified as a range, yes? Any range the specifier wants (and can legitimately work with), yes? What is it about peer dependencies that give the host more flexibility in choosing the specific version? Real question, not a challenge! I really don't understand this stuff, I've always found javascript dependency management very confusing.
      - chain-- 5y ago
        I could be wrong but I think it is used to alert you when you have incompatible dependencies. For example if you have a dependency with a peerDependency `something: 2.x.x` and you currently have `something: 1.0.0` installed as a direct dependency, it will fail rather than allowing multiple versions to be run.
      - eyelidlessness 5y ago
        It allows packages to specify a wider version range for downstream users than a pinned version used in `devDependencies`. This is a common pattern if (say) your tests depend on certain less stable APIs but your published package only uses a smaller more stable subset. It’s especially useful if you want to support older semver-major versions, or even newer ones if you’re confident that the APIs you use will remain stable. The example used in this post[1] on the Node blog is plugin systems, which is a very common expression of this pattern. > Real question, not a challenge! I really don't understand this stuff, I've always found javascript dependency management very confusing. I appreciate the clarification but it was clear to me the question was sincere FWIW! And yeah, a lot of this was hard for me to get a solid grasp on for quite a while. I think this tends to show up more in the JS ecosystem because semver was so eagerly adopted there, but I suspect it’s of similar benefit where semver is used and dev/prod dependencies is a proscribed distinction generally. 1: https://nodejs.org/es/blog/npm/peer-dependencies/ https://nodejs.org/es/blog/npm/peer-dependencies/
- jakubmazanec 5y ago
  I want to specify only those deps that I use directly. Imagine a `foobar` package, that has `babel` peer dependency because it does some transpiling or whatever. For me as a user of `foobar`, that Babel requirement could have been regular dependency instead of peer. I don't care, I don't use Babel. In another words - if a package manager has all the information necessary to install all dependencies, why should I add another, redundant information to my package.json?
  - jrochkind1 5y ago
    I am so confused about the purpose of a "peer dependency" in the first place then.
    - jakubmazanec 5y ago
      You can read here why the peer deps were introduced: https://nodejs.org/es/blog/npm/peer-dependencies/ https://nodejs.org/es/blog/npm/peer-dependencies/ Imagine this structure of packages: your-app/ ├── dep-a/ │ └── dep-c ├── dep-b └── peer-dep Very simplified: `dep-c` is dependency of `dep-a`, so it is installed in its node_modules, but `peer-dep` is peer dependency of `dep-a`, so it is in node_modules of `your-app`. `dep-b` could also define `peer-dep` as its peer dependency, so it is installed only once. When npm switched to flat node_modules structure, peer deps become somewhat redundant, but not quite. Pnpm, which uses symlinks to achieve proper node_modules structure while avoiding long filenames, combined with auto install of peer deps would be ideal package manager.
  - ricardobeat 5y ago
    As the post you shared yourself explains, peer dependencies were meant for plugins/extensions. It would make no sense for you to depend on “foobar” directly without having babel as a dependency already. If foobar can be used standalone, then babel is a standard dependency, not a peer dept.
    - jakubmazanec 5y ago
      Technically true, but not how it is actually done. People very often specify packages like Babel, React, TypeScript, GraphQL, etc. as peer dependencies even when they shouldn't. Anyway, in any case, auto installing peer deps solves both situations. There really is no reason to not auto install them.

ricardobeat 5y ago

Isn't that exactly how it's supposed to be? If you're installing a package that has peer dependencies, you should already depend on them. Otherwise they are not "peer dependencies" anymore, just a normal dependency with a version range. The whole peer dependencies story is another clusterfuck. Everyone simply ignored the invalid peer dependency warnings, and now npm itself will just install all of them in 'whatever works' version. To get real peer dependency resolution you need a --strict-peer-deps flag. Not exactly a "feature" in my book.

Wronnay 5y ago
Yeah - this peer dependency thing always makes issues, when I try to upgrade a big Ionic project... Peer dependencies added more problems than they solved in my eyes... Most peer dependencies warnings come because some maintainer forgot to update the package.json and not really because two packages don't work with each other...
- eyelidlessness 5y ago
  The point of peer dependencies is to allow users more flexibility in choosing the specific version of the dependency. It’s not intended to specify any kind of conflict between the packages, it’s effectively BYO sub-dependency.
  - jrochkind1 5y ago
    regular traditional dependencies can already be specified as a range, yes? Any range the specifier wants (and can legitimately work with), yes? What is it about peer dependencies that give the host more flexibility in choosing the specific version? Real question, not a challenge! I really don't understand this stuff, I've always found javascript dependency management very confusing.
    - chain-- 5y ago
      I could be wrong but I think it is used to alert you when you have incompatible dependencies. For example if you have a dependency with a peerDependency `something: 2.x.x` and you currently have `something: 1.0.0` installed as a direct dependency, it will fail rather than allowing multiple versions to be run.
    - eyelidlessness 5y ago
      It allows packages to specify a wider version range for downstream users than a pinned version used in `devDependencies`. This is a common pattern if (say) your tests depend on certain less stable APIs but your published package only uses a smaller more stable subset. It’s especially useful if you want to support older semver-major versions, or even newer ones if you’re confident that the APIs you use will remain stable. The example used in this post[1] on the Node blog is plugin systems, which is a very common expression of this pattern. > Real question, not a challenge! I really don't understand this stuff, I've always found javascript dependency management very confusing. I appreciate the clarification but it was clear to me the question was sincere FWIW! And yeah, a lot of this was hard for me to get a solid grasp on for quite a while. I think this tends to show up more in the JS ecosystem because semver was so eagerly adopted there, but I suspect it’s of similar benefit where semver is used and dev/prod dependencies is a proscribed distinction generally. 1: https://nodejs.org/es/blog/npm/peer-dependencies/ https://nodejs.org/es/blog/npm/peer-dependencies/
jakubmazanec 5y ago
I want to specify only those deps that I use directly. Imagine a `foobar` package, that has `babel` peer dependency because it does some transpiling or whatever. For me as a user of `foobar`, that Babel requirement could have been regular dependency instead of peer. I don't care, I don't use Babel. In another words - if a package manager has all the information necessary to install all dependencies, why should I add another, redundant information to my package.json?
- jrochkind1 5y ago
  I am so confused about the purpose of a "peer dependency" in the first place then.
  - jakubmazanec 5y ago
    You can read here why the peer deps were introduced: https://nodejs.org/es/blog/npm/peer-dependencies/ https://nodejs.org/es/blog/npm/peer-dependencies/ Imagine this structure of packages: your-app/ ├── dep-a/ │ └── dep-c ├── dep-b └── peer-dep Very simplified: `dep-c` is dependency of `dep-a`, so it is installed in its node_modules, but `peer-dep` is peer dependency of `dep-a`, so it is in node_modules of `your-app`. `dep-b` could also define `peer-dep` as its peer dependency, so it is installed only once. When npm switched to flat node_modules structure, peer deps become somewhat redundant, but not quite. Pnpm, which uses symlinks to achieve proper node_modules structure while avoiding long filenames, combined with auto install of peer deps would be ideal package manager.
- ricardobeat 5y ago
  As the post you shared yourself explains, peer dependencies were meant for plugins/extensions. It would make no sense for you to depend on “foobar” directly without having babel as a dependency already. If foobar can be used standalone, then babel is a standard dependency, not a peer dept.
  - jakubmazanec 5y ago
    Technically true, but not how it is actually done. People very often specify packages like Babel, React, TypeScript, GraphQL, etc. as peer dependencies even when they shouldn't. Anyway, in any case, auto installing peer deps solves both situations. There really is no reason to not auto install them.