Strict Peer Dependency Enforcement: Deciding on Automatic Peer Installation in CI Deployments

Strict Peer Dependency Enforcement

pnpm’s strict peer dependency enforcement requires a host project to declare a compatible version of any peer dependency that a package requests. If the declared range does not match the installed package’s peer dependency, pnpm aborts the install with a clear error message.

Deployment Failure Scenario

In a CI pipeline, a package that declares a peer dependency is pulled in, but the CI environment’s package.json does not list the required peer. Since pnpm does not automatically install peer dependencies, the deployment fails during the install step, causing the pipeline to break.

Unresolved Decision

• Should pnpm automatically add missing peer dependencies during CI installs, or must the pipeline explicitly list them?
• What impact would auto‑installation have on reproducibility and security of the CI environment?
• How can we best document or enforce the requirement for explicit peer dependency specification in project documentation?