{"action":"created","issue":{"url":"https://api.github.com/repos/npm/npm/issues/5080","labels_url":"https://api.github.com/repos/npm/npm/issues/5080/labels{/name}","comments_url":"https://api.github.com/repos/npm/npm/issues/5080/comments","events_url":"https://api.github.com/repos/npm/npm/issues/5080/events","html_url":"https://github.com/npm/npm/issues/5080","id":31567558,"number":5080,"title":"npm link and multiple levels of peerDependencies = psychedelic mess","user":{"login":"mpj","id":17815,"avatar_url":"https://avatars.githubusercontent.com/u/17815?v=3","gravatar_id":"","url":"https://api.github.com/users/mpj","html_url":"https://github.com/mpj","followers_url":"https://api.github.com/users/mpj/followers","following_url":"https://api.github.com/users/mpj/following{/other_user}","gists_url":"https://api.github.com/users/mpj/gists{/gist_id}","starred_url":"https://api.github.com/users/mpj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpj/subscriptions","organizations_url":"https://api.github.com/users/mpj/orgs","repos_url":"https://api.github.com/users/mpj/repos","events_url":"https://api.github.com/users/mpj/events{/privacy}","received_events_url":"https://api.github.com/users/mpj/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/npm/npm/labels/peerdependencies","name":"peerdependencies","color":"beefed"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":142,"created_at":"2014-04-15T16:12:18Z","updated_at":"2015-10-30T20:32:19Z","closed_at":"2015-10-29T16:33:24Z","body":"So _npm link_ behaves in (what I think is) an unexpected way when you multiple levels of packages that depend on the same _peerDependency_. \r\n\r\nLook at the dependency chain below. I have a Knockout app, _spotify-app_, that relies on a _spotify-framework_ module that in turn relies on a _spotify-library_ module. All three depend on _knockout_ and it's very important that there is only one instance of Knockout in the app because reasons. Thus, _spotify-app_ requires _knockout_ as a normal dependency, and the _spotify-framework_ and _spotify-library_ module both list it as a _peerDependency_. This dependency chain **works fine**, until you decide to do development on the _spotify-framework_ module and try to use _npm link_ - then the mad hatter comes in and gives you spiked cookies and everything goes pink fluffy unicorns dancing on rainbows.\r\n\r\nThis is what happens: You happily clone the _spotify-framework_ from git, and then you run _npm link_ in its directory, in preparation of linking it in from _spotify-app_. The problem here is that _npm link_ will run spm install (I think) under the hood. npm will look at the _peerDependencies_ of _spotify-library_, and then install an instance of _knockout_ inside the node_modules of _spotify-framework_, because it thinks that _spotify-framework_ is the top-level module. This will silently cause ***duplicate versions*** on _knockout_, because _spotify-app_ will install another instance of _knockout_ itself. It's obvious what happens when I write it down like this, but it was extremely confusing to figure out what happened here, I tell you. \r\n\r\nI'm not sure how this should be solved, but I'm leaning towards that npm link should never install peerDependencies on it's own, because it's most likely not the top-level module if it's being linked. \r\n\r\n```javascript\r\n{\r\n  \"name\": \"spotify-app\",\r\n  \"version\": \"0.0.1\",\r\n  \"private\": \"true\",\r\n  \"dependencies\": {\r\n    \"knockout\": \"~3.0.0\",      \r\n    \"spotify-framework\": \"0.0.1\"\r\n  }\r\n}\r\n\r\n{\r\n  \"name\": \"spotify-framework\",\r\n  \"version\": \"0.0.1\",\r\n  \"private\": \"true\",\r\n  \"peerDependencies\": {\r\n        \"knockout\": \"^3.0.0\",\r\n  },\r\n  \"dependencies\": {\r\n    \"spotify-library\": \"0.0.1\"\r\n  }\r\n}\r\n\r\n{\r\n  \"name\": \"spotify-library\",\r\n  \"version\": \"0.0.1\",\r\n  \"private\": \"true\",\r\n  \"peerDependencies\": {\r\n        \"knockout\": \"^3.0.0\",     \r\n  }\r\n}\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/npm/npm/issues/comments/152644608","html_url":"https://github.com/npm/npm/issues/5080#issuecomment-152644608","issue_url":"https://api.github.com/repos/npm/npm/issues/5080","id":152644608,"user":{"login":"gajus","id":973543,"avatar_url":"https://avatars.githubusercontent.com/u/973543?v=3","gravatar_id":"","url":"https://api.github.com/users/gajus","html_url":"https://github.com/gajus","followers_url":"https://api.github.com/users/gajus/followers","following_url":"https://api.github.com/users/gajus/following{/other_user}","gists_url":"https://api.github.com/users/gajus/gists{/gist_id}","starred_url":"https://api.github.com/users/gajus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gajus/subscriptions","organizations_url":"https://api.github.com/users/gajus/orgs","repos_url":"https://api.github.com/users/gajus/repos","events_url":"https://api.github.com/users/gajus/events{/privacy}","received_events_url":"https://api.github.com/users/gajus/received_events","type":"User","site_admin":false},"created_at":"2015-10-30T20:32:19Z","updated_at":"2015-10-30T20:32:19Z","body":"Correct me if I am wrong, but npm link does not install devDependencies. Even if you npm install; npm link, devDependencies will not be made available to the script being linked.\n\n> On Oct 30, 2015, at 20:03, José Magalhães <notifications@github.com> wrote:\n> \n> So actually the issue still persists if for instance the lib being linked have for instance React as a devDependency so that tests can be executed?\n> \n> —\n> Reply to this email directly or view it on GitHub.\n> \n"}}