GPR npm optional peerDependencies issue

[zoncrd]

Select Topic Area

Bug

Body

I am writing to report an issue with the GitHub Package Registry. Specifically, I am having trouble installing an npm package that specifies optional peerDependencies.

When attempting to install a package that specifies optional peerDependencies in the package.json via the peerDependenciesMeta attribute from the GitHub Package Registry, optional dependencies are installed anyway.

I have verified that the package installs successfully when installed from other registries such as NPM. Therefore, it seems likely that there is an issue with the GitHub Package Registry that is preventing the installation of packages with optional peer dependencies.

I have found that the problem seems to be caused by a missing property in the abbreviated package metadata response. The missing property is the peerDependenciesMeta field, without which, npm version 7 and above automatically installs peerDependencies.

You can find more details in this sample repository reproducing the issue.

Here is a related thread that led me to understand the problem.

Any help or assistance is appreciated, please let me know if there are any further details or information that I can provide to help diagnose the issue

[naoki-kiryu-lvgs]

I asked GitHub support about this, and they assured me that it's already in their backlog, although they couldn't provide an estimated time of arrival (ETA).

[chriscarpenter12]

I too followed up with a GitHub support ticket and got the same response:

I have added your request to the tracking issue, but also as noted in the community discussion, there is not currently any ETA for when this might be available. When we have any further news to share, we’ll make sure to document it in the GitHub Changelog or the GitHub Blog.

[noahnu]

I reported this through GitHub Enterprise support. They consider this a feature request and not a bug. No ETA. I was told the npm docs aren't considered documentation/specifications for their github package registry (ghcr) product.

[marcalexiei]

I also contacted GitHub Support about this.

They confirmed that peerDependenciesMeta is currently not supported by GitHub Package Registry,
that this is a known item on their backlog, and that there is no ETA, with a fix unlikely in the near term.

Support also indicated they are adding this report to an escalation so the team is aware there is demand for the feature.

Hopefully, additional reports from others will help increase the priority of addressing this issue.

[mwstr]

When I host my private library on github registry it doesn't see peerDependenciesMeta.*.optional: true and installs all peer dependencies bloating node_modules:

when I do the same thing with verdaccio or with local tgz package it works as intended:

Furthermore this breaks my library logic in CJS projects. Becuse I try to optionally load this peer libraries and some of them are ESM. And at the moment Node.js can't load ESM from CJS without additional experimental flag

[mrbrentkelly]

Just experienced this issue myself when moving some node packages over from a privately hosted registry to a GitHub Package Registry. Is this the best place to subscribe to to get updates on a fix?

[lauripiisang]

Experienced the same, local verdaccio works correctly, GPR omits necessary peerDependenciesMeta, creating a bloated and sometimes broken dependency chart.

Example that I experienced:

• package p1 that has an optional peerDependency, which has a dependency of react 19
• package p2 that has a strict dependency of react 18, or other depedencies that require react 18 (<19)
• installing p1 into p2 is impossible, because although p1 does not need react, GPR makes it so that react 19 is required to be installed by p1

Only valid solution currently is to move away from using GPR in favor of any vendor that behaves correctly (e.g. npm)