[BUG] `peerDependency` package version doesn't resolve correctly

[SukkaW]

Is there an existing issue for this?

• I have searched the existing issues

There are some similar existing issues like #4442 and #4104, don't know if they are related.

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR!
npm ERR! While resolving: [Redacted]
npm ERR! Found: next@12.1.7-canary.23
npm ERR! node_modules/next
npm ERR!   next@"^12.1.7-canary.23" from the root project
npm ERR!
npm ERR! Could not resolve dependency:
npm ERR! peer next@">=10.2.0" from eslint-config-next@12.1.7-canary.23
npm ERR! node_modules/eslint-config-next
npm ERR!   dev eslint-config-next@"^12.1.7-canary.23" from the root project
npm ERR!
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.

Expected Behavior

npm should be able to resolve the dependency tree since eslint-config-next requires a peer dependency of next >= 10.2.0, which 12.1.7-canary.23 does satisfy the constraint.

Steps To Reproduce

$ npm -v
8.11.0
$ mkdir -p npm-issue-peer-deps
$ cd npm-issue-peer-deps
$ npm init -y
$ npm i next@canary eslint-config-next@canary

Environment

• npm: 8.11.0
• Node.js: 16.15.0
• OS Name: macOS 12.4
• System Model Name: 16.15.0

[shadowspawn]

I think this is probably as intended. npm does not include prerelease versions when looking for >= 10.2.0, so 12.1.7-canary.23 is not a candidate.

You can try this out in the semver calculator:
https://semver.npmjs.com

[nlf]

this is, indeed, intended. prereleases are a bit tricky that way. you might consider taking a look at the docs for overrides to help you force it though!

[SukkaW]

Finally, someone else starts to complaining about the same thing: https://twitter.com/dan_abramov/status/1641574203617943557

so what’s the latest on peer dependencies and unreleased versions? it’s a major PITA.

to recap the situation, we have prerelease React canary versions like "18.3.0-next-12345". and React ecosystem libraries declare compat like "^18" which does not match prereleases.

npm errors.

[SukkaW]

Months later, there is a new victim.

https://twitter.com/NicoloRibaudo/status/1682341361251385345

I'm very confused by how semver works (testing it with https://semver.npmjs.com on @ babel/core).

"^7.25.0 || ^8.0.0-0 <8.0.0" matches 8.0.0-alpha.0 but "^7.22.0 || ^8.0.0-0 <8.0.0" doesn't?