[BUG] npm install not installing peer dependencies automatically and removing them from package-lock.json

[anurag-roy]

Is there an existing issue for this?

• I have searched the existing issues
• I guess it is related to [BUG] non-previosly seen peer-dependency errors popping up in 8.6.0 #4664, but that issue is closed

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

When running npm install, it does not install the peer dependencies automatically even if they are in the package-lock.json file.
Instead it modifies the package-lock.json file removing all the peer dependencies.
Fwiw, the package-lock.json file was generated while we were using npm v7.

Expected Behavior

I was using npm v8.5.5 before upgrading today and on v8.5.5 all peer dependencies were being installed automatically (I guess we have them in our package-lock.json).
But now on the latest version v8.10.0 I am facing missing package errors while building.

Is this the intended behaviour now?

Steps To Reproduce

I can provide a minimal reproducible example if you can confirm that this is not intended/known.

Environment

• npm: 8.10.0
• Node.js: 16.15.0
• OS Name: Ubuntu 20.04.4 LTS x86_64
• System Model Name: Dell Latitude 5590
• npm config:

loglevel = "notice"

If I remember correctly, npm 7 introduced the feature of auto installing peer dependencies. What is the stance on peer deps now in npm 8? Should we include all peer deps in our package.json?

[ljharb]

You should always explicitly include them, even though npm 7+ auto-installs them.

[fritzy]

Unfortunately, it was a bug that peer dependencies were installed when they weren't a dependency. Now that we're checking the lockfile with the dependency tree, you'll need to generate a new lockfile.

[anurag-roy]

Ok got it! Thanks for confirming @ljharb and @fritzy!

[lasley]

For any future internet peepz landing here due to a Google search, check if you have a .npmrc at the root of your package & if it does, make sure it hasn't enabled legacy-peer-deps.

[eddiemonge]

Unfortunately, it was a bug that peer dependencies were installed when they weren't a dependency

Since when? npm7 made a big deal about installing them after it was removed in a previous version https://github.blog/2021-02-02-npm-7-is-now-generally-available/#peer-dependencies

[vblackwhale]

For any future internet peepz landing here due to a Google search, check if you have a .npmrc at the root of your package & if it does, make sure it hasn't enabled legacy-peer-deps.

To build on top of this, just know the error inducing .npmrc file can be in 4 places:

• per-project configuration file (/path/to/my/project/.npmrc)
  

• per-user configuration file (defaults to $HOME/.npmrc; configurable via CLI option --userconfig or environment variable $NPM_CONFIG_USERCONFIG)
  

• global configuration file (defaults to $PREFIX/etc/npmrc; configurable via CLI option --globalconfig or environment variable $NPM_CONFIG_GLOBALCONFIG)
  

• npm's built-in configuration file (/path/to/npm/npmrc)
  

If you often work with React you may have hardcoded the --legacy-peer-deps flag into one of these config files and it is now overriding normal behaviour by not installing peer dependencies.

[jtakalai]

I had this problem and it was caused by the following lines in .npmrc:

# See bug in peerdeps resolution: https://github.com/npm/cli/issues/2999
legacy-peer-deps = true

Removing those lines helped. Apparenly the issue it referenced has been fixed since nothing broke when I just deleted the lines.

[Dacili]

I had the same issue with npm not installing peer dependencies of packages. I had tried so many solutions, this worked for me.
1. make sure you're using the correct versions of node, npm, ng:

  node -v
  npm -v
  ng v

My versions were these:

2. enter this command, to see where you have .npmrc files on your PC:
npm config ls -l
It will list your npm configuration, and you will see next to settings if it's overridden by some configuration. In my case
;legacy-peer-deps = false; overridden by global config, making it to true.
for ex.

at the end of generated settings, you will see a locations of .npmrc files that are overriding something.

Go to that config, and remove the legacy-peer-deps setting. I had to remove this line in 2 different .npmrc files.
3. delete node_modules of that project
I simply selected everything from node_modules, and hit delete. Previously closed visual studio for that project. And then removed empty node_modules folder.
4. clean cache with npm cache clean --force
5. if you made any changes to package-lock.json file, revert it.
6. Hit npm install.
Peer dependencies should be installed correctly!

7. When I was trying to do ng serve I was getting errors such as
   Error: export 'fontHelper' (imported as 'fontHelper') was not found in '@cometchat/chat-uikit-angular' (possible exports:..
   https://stackoverflow.com/questions/75959038/angular-library-error-export-x-imported-as-x-was-not-found-in-my-pkg-my
   so I had to delete .angular folder, and do ng build, and ng serve.
   
   And finally everything worked!