incorrectly uses devDependecies for peer dependency verification since pnpm v6.32.12

[czheji]

pnpm version: ^6.32.12 || ^7.0.0

Code to reproduce the issue:

package.json:

{
  "name": "bug",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "",
  "license": "ISC",
  "dependencies": {
    "vue": "^2.6.11"
  },
  "devDependencies": {
    "vue-loader":"~16.8.3", 
    "webpack":"^4.1.0"
  }
}

command & result:

>~/.rush/node-v16.15.0/pnpm-6.32.12/node_modules/.bin/pnpm install --strict-peer-dependencies
Already up-to-date
 ERR_PNPM_PEER_DEP_ISSUES  Unmet peer dependencies

.
└─┬ vue-loader
  └── ✕ unmet peer vue@^3.2.13: found 2.6.14

Progress: resolved 37, reused 37, downloaded 0, added 0
>rm -rf pnpm-lock.yaml
>~/.rush/node-v16.15.0/pnpm-6.32.11/node_modules/.bin/pnpm i --strict-peer-dependencies
Packages: +1 -1
+-
Progress: resolved 37, reused 37, downloaded 0, added 1, done

devDependencies:
- vue-loader 16.8.3
+ vue-loader 16.8.3

Expected behavior: success

Actual behavior:

ERR_PNPM_PEER_DEP_ISSUES  Unmet peer dependencies

.
└─┬ vue-loader
└── ✕ unmet peer vue@^3.2.13: found 2.6.14

Additional information:

I see that vue@3.2.13 appear in vue-loader's devDependencies, not peerDependencies, which should not be used for peer verification.

• node -v prints: v16.15.0
• Windows, macOS, or Linux?: Linux

[czheji]

The initial error was that I was using vue2 in an old project and referenced "@vue/cli-service:~4.5.0" in devDependecies,
package.json:

{
  "name": "bug",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "",
  "license": "ISC",
  "dependencies": {
    "vue": "^2.6.11"
  },
  "devDependencies": {
    "@vue/cli-service":"~4.5.0"
  }
}

pnpm install --strict-peer-dependencies with the similar error:

node_modules/.pnpm/ejs@2.7.4/node_modules/ejs: Running postinstall script, done in 67ms

devDependencies:
+ @vue/cli-service 4.5.18 (5.0.6 is available)
- vue-loader 16.8.3
- webpack 4.46.0

 ERR_PNPM_PEER_DEP_ISSUES  Unmet peer dependencies

.
└─┬ @vue/cli-service
  └─┬ vue-loader
    └── ✕ unmet peer vue@^3.2.13: found 2.6.14

Although this may be that the peer dependencies of vue2 are not standard,
but the development dependencies of the development dependencies in my project cannot be verified as peer dependencies,
which should not meet the original intention of peer dependencies.

[zkochan]

Actually, vue is in the peer dependencies of vue-loader because we use Yarn's compatibility database which adds to peer deps:

https://github.com/yarnpkg/berry/blob/20612e82d26ead5928cc27bf482bb8d62dde87d3/packages/yarnpkg-extensions/sources/index.ts#L521-L531

[czheji]

But I see from vue-loader's github , vue is not in the peer dependencies of vue-loader, Neither v16.8.3 nor v16.7.0:

https://github.com/vuejs/vue-loader/blob/v16.8.3/package.json
https://github.com/vuejs/vue-loader/blob/v16.7.0/package.json

This seems to be a bug with the Yarn's compatibility database.

From common sense, vue-loader is the loader of webpack, which is a development dependency, and should not introduce peer dependencies from it.

[zkochan]

But I see from vue-loader's github , vue is not in the peer dependencies of vue-loader, Neither v16.8.3 nor v16.7.0:

Well, that is exactly why it is in Yarn's compatibility database. I don't know if it is needed or not. Probably there is a reason it was added.

As you can see, a related PR is open: vuejs/vue-loader#1944

[sodatea]

vue-loader v16 & v17 does require vue v3 as a peer dependency because it requires vue/compiler-sfc.
I've added the necessary fields in v17.0.1.

For Vue 2.x please use vue-loader v15.

The error message is indeed correct and useful.