@pnpm/lockfile.detect-dep-types 1100.0.24 → 1100.0.25

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @pnpm/lockfile.detect-dep-types
 
+## 1100.0.25
+
+### Patch Changes
+
+- `pnpm install --prod`, `pnpm fetch --prod` and `pnpm deploy --prod` no longer install a devDependency that is only there to satisfy an optional peer dependency of a production dependency. `pnpm list`, `pnpm why`, `pnpm licenses`, `pnpm sbom` and `pnpm audit` leave it out of `--prod` results too. The same applies to `--dev`. A peer that is not optional is still installed and audited [#15344](https://github.com/pnpm/pnpm/issues/15344).
+
+- Updated dependencies:
+  - @pnpm/deps.path@1101.0.4
+  - @pnpm/lockfile.types@1100.1.3
+  - @pnpm/types@1102.1.1
+
 ## 1100.0.24
 
 ### Patch Changes

package/lib/index.d.ts

@@ -1,3 +1,4 @@
+import { type PeerSatisfactionEdgesOptions } from '@pnpm/lockfile.peer-edges';
 import type { LockfileObject } from '@pnpm/lockfile.types';
 export declare const DepType: {
     readonly DevOnly: 0;
@@ -6,4 +7,9 @@ export declare const DepType: {
 };
 export type DepType = (typeof DepType)[keyof typeof DepType];
 export type DepTypes = Record<string, DepType>;
-export declare function detectDepTypes(lockfile: LockfileObject): DepTypes;
+/**
+ * Classifies every package reachable from the importers. Peer-satisfaction
+ * edges (see `@pnpm/lockfile.peer-edges`) are not followed: a devDependency
+ * that only satisfies an optional peer of a production package is dev-only.
+ */
+export declare function detectDepTypes(lockfile: LockfileObject, opts?: PeerSatisfactionEdgesOptions): DepTypes;

package/lib/index.js

@@ -1,10 +1,16 @@
 import * as dp from '@pnpm/deps.path';
+import { getPeerSatisfactionEdges, isPeerSatisfactionEdge, } from '@pnpm/lockfile.peer-edges';
 export const DepType = {
     DevOnly: 0,
     DevAndProd: 1,
     ProdOnly: 2,
 };
-export function detectDepTypes(lockfile) {
+/**
+ * Classifies every package reachable from the importers. Peer-satisfaction
+ * edges (see `@pnpm/lockfile.peer-edges`) are not followed: a devDependency
+ * that only satisfies an optional peer of a production package is dev-only.
+ */
+export function detectDepTypes(lockfile, opts) {
     const dev = {};
     const devDepPaths = Object.values(lockfile.importers)
         .map((deps) => resolvedDepsToDepPaths(deps.devDependencies ?? {})).flat();
@@ -17,6 +23,7 @@ export function detectDepTypes(lockfile) {
         walked: new Set(),
         notProdOnly: new Set(),
         dev,
+        peerSatisfactionEdges: getPeerSatisfactionEdges(lockfile, opts),
     };
     detectDepTypesInSubGraph(ctx, devDepPaths, {
         dev: true,
@@ -49,14 +56,15 @@ function detectDepTypesInSubGraph(ctx, depPaths, opts) {
             ctx.dev[depPath] = DepType.ProdOnly;
         }
         const depLockfile = ctx.packages[depPath];
-        const newDependencies = resolvedDepsToDepPaths(depLockfile.dependencies ?? {});
+        const newDependencies = resolvedDepsToDepPaths(depLockfile.dependencies ?? {}, ctx.peerSatisfactionEdges, depPath);
         detectDepTypesInSubGraph(ctx, newDependencies, opts);
-        const newOptionalDependencies = resolvedDepsToDepPaths(depLockfile.optionalDependencies ?? {});
+        const newOptionalDependencies = resolvedDepsToDepPaths(depLockfile.optionalDependencies ?? {}, ctx.peerSatisfactionEdges, depPath);
         detectDepTypesInSubGraph(ctx, newOptionalDependencies, { dev: opts.dev });
     }
 }
-function resolvedDepsToDepPaths(deps) {
+function resolvedDepsToDepPaths(deps, peerSatisfactionEdges, parent) {
     return Object.entries(deps)
+        .filter(([alias]) => parent == null || !isPeerSatisfactionEdge(peerSatisfactionEdges, parent, alias))
         .map(([alias, ref]) => dp.refToRelative(ref, alias))
         .filter((depPath) => depPath !== null);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/lockfile.detect-dep-types",
-  "version": "1100.0.24",
+  "version": "1100.0.25",
   "description": "Detect the types of dependencies",
   "keywords": [
     "pnpm",
@@ -29,12 +29,13 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/deps.path": "1101.0.3",
-    "@pnpm/lockfile.types": "1100.1.2",
-    "@pnpm/types": "1102.1.0"
+    "@pnpm/deps.path": "1101.0.4",
+    "@pnpm/lockfile.peer-edges": "1100.0.0",
+    "@pnpm/lockfile.types": "1100.1.3",
+    "@pnpm/types": "1102.1.1"
   },
   "devDependencies": {
-    "@pnpm/lockfile.detect-dep-types": "1100.0.24",
+    "@pnpm/lockfile.detect-dep-types": "1100.0.25",
     "tempy": "3.0.0"
   },
   "engines": {