Node module dependency bug

[Jhays10]

Do you want to request a feature or report a bug?
Bug

What is the current behavior?
The requested package version is being ignored and substituted with a sub-package module in another dependency.

If the current behavior is a bug, please provide the steps to reproduce.

• Create new project, run yarn init -y.
• yarn add [email protected]
• yarn add leaflet-virtual-grid@latest
• cd node_modules/leaflet-virtual-grid/node_modules/leaflet and vim package.json

What is the expected behavior?
When leaflet-virtual-grid is installed, its leaflet dependency shouldn't be installed, as it's already included previously. This is working correctly in NPM v5. In NPM v5, the node_modules for leaflet-virtual-grid are not installed and it will use the existing leaflet dependency.

Please mention your node.js, yarn and operating system version.

• Node.js - v8.1.4
• NPM - v5.0.3
• Yarn - v0.27.5
• MacOS - 10.12.5

[BYK]

This is weird. I'd expect 1.0.x to not be compatible with ^1.0.0-rc.1 which is what leaflet-virtual-grid lists but semver says otherwise:

> semver.satisfies('1.0.3', '^1.0.0-rc.1')
true

@arcanis any ideas?

[BYK]

@arcanis this also looks similar to #3967

[arcanis]

Well it's the same issue as #3951 - leaflet-virtual-grid is using a dependencies entry instead of a peerDependencies, so they get resolved to two different versions ...

[arcanis]

That being said, as @BYK noticed the hoisting should probably still have worked in this particular case since 1.0.3 is compatible with ^1.0.0-rc.1. Hm.

(I still advise you to open an issue on leaflet-virtual-grid to fix this peerDependencies thing, tho - their dependencies are currently unsafe and subject to breakages)

[Jhays10]

Unfortunately it looks as if that project is not maintained anymore. In our project, we don't actually require leaflet-virtual-grid to be installed, it's actually a dependency through esri-leaflet which we do require. But it's certainly worth a shot of creating an issue over there as well.