[BUG] --force doesn't work when updating a package to an invalid peer dep resolution

[billyjanitsch]

Current Behavior

When you have installed from a package.json containing a valid peer dep resolution and try to install a package that would create an invalid resolution, adding the --force flag doesn't work.

Steps to Reproduce

Start from this package.json:

{
  "dependencies": {
    "webpack": "^4.0.0",
    "webpack-dev-server": "^3.0.0"
  }
}

Run npm install. The install completes successfully.

Then, run npm install webpack@5 --force. webpack@5 has a peer dependency issue with webpack-dev-server@3, but the --force argument should allow the invalid installation (per #180). Instead, the install errors and bails:

npm WARN using --force Recommended protections disabled.
npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! Found: webpack@5.5.0
npm ERR! node_modules/webpack
npm ERR!   webpack@"5" from the root project
npm ERR!   peer webpack@"^4.0.0 || ^5.0.0" from webpack-dev-server@3.11.0
npm ERR!   node_modules/webpack-dev-server
npm ERR!     webpack-dev-server@"^3.11.0" from the root project
npm ERR!   1 more (terser-webpack-plugin)
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer webpack@"^4.0.0" from webpack-dev-middleware@3.7.2
npm ERR! node_modules/webpack-dev-middleware
npm ERR!   webpack-dev-middleware@"^3.7.2" from webpack-dev-server@3.11.0
npm ERR!   node_modules/webpack-dev-server
npm ERR!     webpack-dev-server@"^3.11.0" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /Users/billy/.npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/billy/.npm/_logs/2020-11-17T18_25_19_838Z-debug.log

Note that if you start from the following package.json and run npm install --force, the install completes (thanks to #182):

{
  "dependencies": {
    "webpack": "^5.0.0",
    "webpack-dev-server": "^3.0.0"
  }
}

Expected Behavior

npm install pkg --force should allow for a valid peer deps resolution to transition to an invalid one without failing to install.

The use case here is: I depend on a@1 which peer depends on b@1. b@2 was just released, and there's a PR in a to widen its peer dep range but it hasn't been released yet. I want to test if b@2 will work in my project.

Who

@isaacs

References

Related to #180.
Related to npm/cli#2123.

[ljharb]

Which version of npm are you using? Can you try with v7.0.11, if that’s not already being used?

[billyjanitsch]

I'm using 7.0.11. My reference to #182 wouldn't apply otherwise.

[isaacs]

This seems to be fixed on the latest arborist. Not sure if the relevant fix is in npm 7.5.0, but it will be in 7.5.1 for sure.