-
Notifications
You must be signed in to change notification settings - Fork 2.1k
Bug: peerDependencies from monorepo packages cause npm resolution errors #5783
Description
Lexical version: All versions since #1396 through at least v0.14.2
Steps To Reproduce
- Create a package.json that depends on an older version of lexical, with at least one associated package from the monorepo that uses peerDependencies, and install it to create an initial package-lock.json e.g.
npm install lexical@0.14.1 @lexical/react@0.14.1 - Attempt to upgrade to a newer version of lexical, e.g.
npm install lexical@latest @lexical/react@latestand get a resolution failure
Link to code example:
https://github.com/facebook/lexical/tree/main/examples/react-rich (or any of the other examples)
The current behavior
Dependency resolution fails with an error
# npm resolution error report
While resolving: @lexical/react-rich-example@0.14.2
Found: @lexical/react@0.13.1
node_modules/@lexical/react
@lexical/react@"0.14.2" from the root project
Could not resolve dependency:
@lexical/react@"0.14.2" from the root project
Conflicting peer dependency: lexical@0.14.2
node_modules/lexical
peer lexical@"0.14.2" from @lexical/react@0.14.2
node_modules/@lexical/react
@lexical/react@"0.14.2" from the root project
Fix the upstream dependency conflict, or retry
this command with --force or --legacy-peer-deps
to accept an incorrect (and potentially broken) dependency resolution.
The expected behavior
npm install succeeds and updates the lexical packages.
Per the node blog on peerDependencies https://nodejs.org/en/blog/npm/peer-dependencies -
One piece of advice: peer dependency requirements, unlike those for regular dependencies, should be lenient. You should not lock your peer dependencies down to specific patch versions. It would be really annoying if one Chai plugin peer-depended on Chai 1.4.1, while another depended on Chai 1.5.0, simply because the authors were lazy and didn't spend the time figuring out the actual minimum version of Chai they are compatible with.
I think it doesn't really make sense in practice to use peerDependencies with all of these packages being updated in lock-step, and likely having interdependencies that are not based on the stable public API. Outside of the monorepo, when packages are not updated in lock-step, it would likely make sense to use peerDependencies on lexical and its associated monorepo packages (although at a glance I haven't found any lexical community packages doing this correctly!)