[BUG] npm install incorrect resolve peerDependencies with exact versioning

[Naymi]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Expected Behavior

install all package version 1.0.6 completely)

Steps To Reproduce

1. In this environment node@18.16.0 npm@9.5.1
2. git clone https://github.com/Naymi/npm-install-incorrect-resolve-peer && cd npm-install-incorrect-resolve-peer
3. Run 'npm install'
4. See error

npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: npm-install-incorrect-resolve-peer@1.0.0
npm ERR! Found: @rsdk/common@1.0.6
npm ERR! node_modules/@rsdk/common
npm ERR!   @rsdk/common@"1.0.6" from the root project
npm ERR!   peer @rsdk/common@"^1.0.6" from @rsdk/core@1.0.6
npm ERR!   node_modules/@rsdk/core
npm ERR!     @rsdk/core@"1.0.6" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer @rsdk/common@"^1.0.8" from @rsdk/decorators@1.0.8
npm ERR! node_modules/@rsdk/decorators
npm ERR!   peer @rsdk/decorators@"^1.0.6" from @rsdk/core@1.0.6
npm ERR!   node_modules/@rsdk/core
npm ERR!     @rsdk/core@"1.0.6" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! 
npm ERR! For a full report see:
npm ERR! /home/gitpod/.npm/_logs/2023-05-19T12_27_37_807Z-eresolve-report.txt

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/gitpod/.npm/_logs/2023-05-19T12_27_37_807Z-debug-0.log

Environment

• npm: 9.5.1
• Node.js: 18.16.0
• OS Name: Ubuntu 22.04.2 LTS x86_64
• System Model Name: Google Compute Engine
• npm config:

; node bin location = /home/gitpod/.nvm/versions/node/v18.16.0/bin/node
; node version = v18.16.0
; npm local prefix = /workspace/npm-install-incorrect-resolve-peer
; npm version = 9.5.1
; cwd = /workspace/npm-install-incorrect-resolve-peer
; HOME = /home/gitpod
; Run `npm config ls -l` to show all defaults.

[ljharb]

It can't, because something requires ^1.0.8, which means 1.0.6 isn't compatible. If you install 1.0.8, it should work.

[Naymi]

It can't, because something requires ^1.0.8, which means 1.0.6 isn't compatible. If you install 1.0.8, it should work.

I need explictly 1.0.6, why i cant do this?

[ljharb]

Because @rsdk/decorators@1.0.8 explicitly says it only works with ^1.0.8, which does not include 1.0.6.

[Naymi]

Потому что @rsdk/decorators@1.0.8прямо сказано, что он работает только с ^1.0.8, который не включает 1.0.6.

I understand perfectly well what's going on) Instead of regressing down the tree and finding a compatible version, namely 1.0.6 of all packages, he mindlessly upgrades it to the latest one which matches "^1.0.6", currently 1.0.8 and when it sees that "@rsdk/decorators" depends on "@rsdk/common" version higher than can be available in local project it just crashes

I can do the work for npm i.e. specify the compatible version I calculated (1.0.6 of all packages), which will lead to an implicit list of dependencies, since the presence of a dependency in the dependencies list does not mean that I need this dependency, perhaps another dependency needs it.
Can I be sure that it is needed in principle? Perhaps @rsdk/decorators will no longer depend on @rsdk/common at some point.
But maybe another package needs @rsdk/common now? If you put all the dependencies of the desired version, then it is not obvious what generally depends on what.
How to update such a package? I can't just update the package to the latest version. I have to manually look through all the versions and write the required range in packages.json.

I think this is what a package manager should do.

[ljharb]

1.0.6 is not compatible, that’s the point - one thing requires 1.0.8.

I’m confused why you want 1.0.6 specifically tho instead of the latest possible 1.x?

[Naymi]

1.0.6 is not compatible, that’s the point - one thing requires 1.0.8.

I’m confused why you want 1.0.6 specifically tho instead of the latest possible 1.x?

1.0.6 is compatible check error message

[ljharb]

Again, the error message is specifically telling you it’s not, because the version of @rsdk/decorators you’re using says that it requires 1.0.8 or higher. Using 1.0.6 is not an option.

[Naymi]

Опять же, сообщение об ошибке специально говорит вам, что это не так, потому что версия, которую @rsdk/decoratorsвы используете, говорит, что для нее требуется 1.0.8 или выше. Использование 1.0.6 не вариант.

There are no @rsdk/decorators in my package.json

[ljharb]

Not directly, but transitively - something is pulling it in.

The point remains, that you can’t use 1.0.6. Why wouldn’t you want to use 1.0.8 if it’s available though?

[Naymi]

Because I cannot guarantee its compatibility with my product

[ljharb]

Semver guarantees it - it’s just two patches away from 1.0.6, so it should only have bug fixes and similar.