[BUG] npm workspace incorrectly flags dependency as optional peer

[acburdine]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

If you're using npm workspaces, npm appears to use the "last occurrence" of a given dependency as the final resolution for a package's "peer" status.

if you have the following three conditions met:

• workspaces config like this:

"workspaces": [
  "apps/*",
  "services/*"
]

• a package in apps has a dev dependency on a package with optional dependencies (in my case, lightningcss is the dev dep and it has optional dependencies for platform-specific lightningcss builds i.e. lightningcss-darwin-arm64)
• a package in services has an optional peer dep on the same dependency (in my case, lightningcss through an optional peer dep from vite)

NPM will mark the optional dependency (e.g. lightningcss-darwin-arm64) as an optional peer dev dependency, and due to the changes in #8431, will no longer install the dependency.

This only occurs if the optional peer dep occurs "last" - if you flip the order of workspaces (swap apps/* and services/*) then it's correctly flagged as an optional (non-peer) dependency. Also, if you make the dev dependency a prod dependency in either package, the behavior does not occur.

Expected Behavior

npm should consider all usages of a package in a workspaces repo before marking a certain dependency as "peer"/"optional" or not.

Steps To Reproduce

1. add the files to a local directory from this gist
2. run npm install
3. run npm why lightningcss-darwin-arm64
4. notice that it's flagged as a "optional" "dev" "peer" dependency
5. run npm install again
6. see that the lightningcss-darwin-arm64 package has been removed.

Environment

• npm: verified on latest v10 and latest v11
• Node.js: v24
• OS Name: macOS Sequoia
• System Model Name: n/a
• npm config: n/a

Apologies if this is a duplicate issue, I tried to find a matching issue but didn't find any that seemed like it fit the problem I was seeing.

[jenseng]

See also #8536 for another repro

[Filipoliko]

Hi, I also ran probably into the same issue, but with a bit different reproduction example.

I created a minimalistic reproduction, that has only one external dependency just to demonstrate the problem. The problem seems to be also related to the optional peer dependency specification and it also gets fixed by re-running the npm install command twice. I think, that this issue was introduced with NPM v8.6.0. Everything works fine with v8.5.x, but all the NPM versions I tried after that failed.

See my reproduction example in this repository -> https://github.com/Filipoliko/npm-peer-resolve-bug (check README.md for how to get started)

[Filipoliko]

@acburdine Did this issue get resolved for you in the latest NPM version? My repro, that I posted above is still not working as expected so I might create a new bug report if my issue is unrelated to this.