npm peer dependencies not being enforced

Question

I am trying to understand peer dependencies in npm, and could not understand the behavior below.

I have the following versions of node and npm :

$ npm -v
8.15.0
$ node -v
v16.17.0

The following directory structure:

peer-dep-test$ tree -I "node_modules"
.
├── library
│   ├── package-lock.json
│   └── package.json
└── project
    ├── package-lock.json
    └── package.json

Library contains the following imports (@altostra/type-validations is used as an example small package here):

{
  "name": "library",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "peerDependencies": {
    "@altostra/type-validations": "2.6.5"
  }
}

and project contains the following:

{

  "name": "project",
  "version": "1.0.0",
  "main": "index.js",
  "devDependencies": {},
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "description": "",
  "dependencies": {
    "@altostra/type-validations": "1.0.2",
    "library": "file:../library"
  }
}

The project project has a version of @altostra/type-validations which should be incompatible with library - but I get no error on doing npm install. npm list gives the following output:

peer-dep-test/project$ npm list --all
project@1.0.0 peer-dep-test/project
├─┬ @altostra/type-validations@1.0.2
│ └─┬ @reactivex/ix-es2015-cjs@3.0.2
│   ├── @types/node@13.13.52
│   └── tslib@1.14.1
└─┬ library@1.0.0 -> ./../library
  └─┬ @altostra/type-validations@2.6.5
    └─┬ @reactivex/ix-es2015-cjs@3.0.2
      ├── @types/node@13.13.52
      └── tslib@1.14.1

As per my understanding of peer dependencies,

library should expect @altostra/type-validations@2.6.5 to be installed directly in project
@altostra/type-validations@1.0.2 should conflict with the peerDependency of library, and either warn or error.

Am I missing something here?

npm peer dependencies not being enforced

0 Answers0