Installing only production dependencies breaks this module

[fredrikekelund]

Hi there, I haven't worked directly with this module, but I work with apostrophe, which depends on syntax-error, which depends on this module. When deploying a site with apostrophe today, I noticed that the deployment failed because of the following error: Error: Cannot find module 'acorn'.

After some digging, I found that the error stemmed from this module, and that I could get rid of it by not running npm install --only=prod, but rather just npm install. I believe the error is due to the fact that acorn@^6 is included in this module's package.json both as a peerDependency and a regular dependency.

Since I haven't been exposed very much to this module, I don't know what the reasoning behind this is, but it seems npm prioritizes peerDependencies and disregards those when only installing production dependencies. Would it be reasonable for this module to remove the peerDependencies field from package.json? Or is there a reason for acorn@^6 being listed both as a peerDependency and a regular dependency?

[adrianheine]

acorn is a peerDependency and a devDependency. peerDependencys are never installed, devDependencys only in certain cases. However, syntax-error depends on acorn-node, which has acorn and acorn-dynamic-import as regular dependencies, so everything should work fine.

[TerryCapan]

Not saying it's this library's fault but I'm running into the same issue with browserify, which depends on insert-module-globals, which depends on acorn-node. As you said, acorn-node has acorn and acorn-dynamic-import as regular dependencies but I still get npm ERR! peer dep missing: acorn@^6.0.0, required by [email protected] when running npm ls. I'm running node v10.13.0 (npm v6.4.1).

[kesne]

You need to install acorn alongside the package.

[worc]

that doesn't make any sense. acorn isn't necessarily a direct dependency of our projects.

[kesne]

@worc it seems like one of the libraries that has this package as a dependency isn’t set up correctly, so I would file the issue there. This package depends on acorn, which is why it is a peer dependency.

[worc]

yeah, it's an issue that crops up periodically, sorry to bother, it's just this is the usual starting point.

the current one i'm looking at is [email protected] pulling in [email protected] and [email protected]. looking at the dependencies listed for webpack and everything seems in order.

but when trying to boot up storybook (which uses webpack to startup a web server or generate static files) i get this error:

[email protected] requires a peer of acorn@^6.0.0

which is just baffling. [email protected] should match npm's resolution of ^6.0.0. which makes me think that there might be some kind of error or bug in npm itself.

[adrianheine]

See also acornjs/acorn#792 for another issue with peer dependencies, in that case it's the wrong version of acorn.

[worc]

it's a dependency resolution / hoisting bug of some kind with npm:

https://npm.community/t/packages-with-peerdependencies-are-incorrectly-hoisted/4794

https://npm.community/t/unmet-peerdependency-but-its-listed-as-a-dependency/5322

there's a fix coming in for [email protected], but it's not fully merged in yet.