Local package peer dependencies cause install errors after prune

[mderrick]

Verify canary release

• I verified that the issue exists in the latest Turborepo canary release.

Link to code that reproduces this issue

https://github.com/mderrick/npm-workspace-deps

Which canary version will you have in your reproduction?

turbo@2.5.9-canary.8

Environment information

turbo 2.5.9-canary.8

CLI:
   Version: 2.5.9-canary.8
   Path to executable: <REDACTED>/npm-workspace-deps/node_modules/turbo-darwin-arm64/bin/turbo
   Daemon status: Not running
   Package manager: npm

Platform:
   Architecture: aarch64
   Operating system: macos
   WSL: false
   Available memory (MB): 14762
   Available CPU cores: 12

Environment:
   CI: None
   Terminal (TERM): xterm-256color
   Terminal program (TERM_PROGRAM): iTerm.app
   Terminal program version (TERM_PROGRAM_VERSION): 3.5.4
   Shell (SHELL): /opt/homebrew/bin/fish
   stdin: false

Expected behavior

I expect npm ci in the turbo prune output directory to work

Actual behavior

npm ci fails with:

npm error Missing: next@15.5.5 from lock file

To Reproduce

Create an NPM workspace that has two apps that depend on different versions of a package (Next 14 and 15 in this case) and then have one local package that both apps depend on with peerDependencies that satisfy both. Turbo prune creates an invalid lockfile:

// apps/app-one
{
  "name": "app-one",
  "dependencies": {
    "@repo/components": "*",
    "next": "^14.0.0"
  }
}

// apps/app-two
{
  "name": "app-two",
  "dependencies": {
    "@repo/components": "*",
    "next": "^15.0.0"
  }
}

// packages/components
{
  "name": "@repo/components",
  "peerDependencies": {
    "next": "^14 || ^15"
  },
}

Additional context

No response

[anthonyshew]

Thanks! Created PR #10988. Will let you know when there's a canary to try.

[anthonyshew]

@mderrick Please have a try with 2.5.9-canary.10.

[mderrick]

Thanks @anthonyshew. I now get this in my provided example repo. Am I missing something?

> npx turbo -v
turbo 2.5.9-canary.10
> npx turbo prune app-two
> cd out
> npm ci
npm error code EUSAGE
npm error
npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm error
npm error Missing: next@15.5.6 from lock file
npm error Invalid: lock file's @next/env@15.5.5 does not satisfy @next/env@15.5.6
npm error Invalid: lock file's @next/swc-darwin-arm64@15.5.5 does not satisfy @next/swc-darwin-arm64@15.5.6
npm error Invalid: lock file's @next/swc-darwin-x64@15.5.5 does not satisfy @next/swc-darwin-x64@15.5.6
npm error Invalid: lock file's @next/swc-linux-arm64-gnu@15.5.5 does not satisfy @next/swc-linux-arm64-gnu@15.5.6
npm error Invalid: lock file's @next/swc-linux-arm64-musl@15.5.5 does not satisfy @next/swc-linux-arm64-musl@15.5.6
npm error Invalid: lock file's @next/swc-linux-x64-gnu@15.5.5 does not satisfy @next/swc-linux-x64-gnu@15.5.6
npm error Invalid: lock file's @next/swc-linux-x64-musl@15.5.5 does not satisfy @next/swc-linux-x64-musl@15.5.6
npm error Invalid: lock file's @next/swc-win32-arm64-msvc@15.5.5 does not satisfy @next/swc-win32-arm64-msvc@15.5.6
npm error Invalid: lock file's @next/swc-win32-x64-msvc@15.5.5 does not satisfy @next/swc-win32-x64-msvc@15.5.6

[mderrick]

@anthonyshew Any further updates on this? It doesn't seem to have solved my issue. The use case provided seem like it should be an extremely common place scenario so would be surprised this doesn't affect more people - unless of course I am I missing something integral here.

[anthonyshew]

I'm still working on it. I'm not seeing other reports of this but a bug is a bug.

[pasquale-merolle]

same bug in dockerfile execution:

Dockerfile (relevant lines)

FROM base AS builder
# Check https://github.com/nodejs/docker-node/tree/b4117f9333da4138b03a546ec926ef50a31506c3#nodealpine to understand why libc6-compat might be needed.
RUN apk update
RUN apk add --no-cache libc6-compat
# Set working directory
WORKDIR /app
RUN npm i -g turbo
COPY . .

# Next.js collects completely anonymous telemetry data about general usage.
# Learn more here: https://nextjs.org/telemetry
# Uncomment the following line in case you want to disable telemetry during the build.
ENV NEXT_TELEMETRY_DISABLED=1

RUN turbo prune @app-name --docker

# Add lockfile and package.json's of isolated subworkspace
FROM base AS installer
RUN apk update
RUN apk add --no-cache libc6-compat
WORKDIR /app

# First install the dependencies (as they change less often)
COPY --from=builder /app/out/json/ .
RUN npm ci

log:

[installer 5/9] RUN npm ci:
1.586 npm error code EUSAGE
1.586 npm error
1.586 npm error npm ci can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with npm install before continuing.
1.586 npm error
1.586 npm error Missing: chevrotain@11.0.3 from lock file
1.586 npm error Missing: @chevrotain/cst-dts-gen@11.0.3 from lock file
1.586 npm error Missing: @chevrotain/gast@11.0.3 from lock file
1.586 npm error Missing: @chevrotain/regexp-to-ast@11.0.3 from lock file
1.586 npm error Missing: @chevrotain/types@11.0.3 from lock file
1.586 npm error Missing: @chevrotain/utils@11.0.3 from lock file
1.586 npm error Missing: cytoscape@3.33.1 from lock file
1.586 npm error Missing: d3-selection@3.0.0 from lock file
1.586 npm error
1.586 npm error Clean install a project
1.586 npm error
1.586 npm error Usage:
1.586 npm error npm ci
1.586 npm error
1.586 npm error Options:
1.586 npm error [--install-strategy <hoisted|nested|shallow|linked>] [--legacy-bundling]
1.586 npm error [--global-style] [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]]
1.586 npm error [--include <prod|dev|optional|peer> [--include <prod|dev|optional|peer> ...]]
1.586 npm error [--strict-peer-deps] [--foreground-scripts] [--ignore-scripts] [--no-audit]
1.586 npm error [--no-bin-links] [--no-fund] [--dry-run]
1.586 npm error [-w|--workspace [-w|--workspace ...]]
1.586 npm error [-ws|--workspaces] [--include-workspace-root] [--install-links]
1.586 npm error
1.586 npm error aliases: clean-install, ic, install-clean, isntall-clean
1.586 npm error
1.586 npm error Run "npm help ci" for more info
1.587 npm notice
1.587 npm notice New major version of npm available! 10.9.4 -> 11.6.3
1.587 npm notice Changelog: https://github.com/npm/cli/releases/tag/v11.6.3
1.587 npm notice To update run: npm install -g npm@11.6.3
1.587 npm notice
1.587 npm error A complete log of this run can be found in: /root/.npm/_logs/2025-11-25T12_06_52_466Z-debug-0.log`

EDIT: I try RUN npm i -g turbo@2.5.9-canary.10 but I have the same error

[superMDguy]

I'm seeing this same issue after adding a shared eslint config, any updates on this?

[anthonyshew]

@superMDguy If there was an update, you would see one. Asking for an update on GitHub is effectively spam, as it sends notifications to everyone who has interacted with the Issue without providing value.

If you'd like to help the Issue move forward, the best thing to do is provide a reproduction. Th next best thing is to add a 👍 to the Issue.