国家预防机制:何时使用`-强制‘和`-遗留-同行-部门`

Question

我对npm很陌生，并试图了解如何重新创建用于部署的node_modules目录。

我们使用npm ci而不是npm install来确保在部署过程中保持干净。但是，当我们在没有任何标志的情况下运行它时，我们会得到以下错误：

修复上游依赖冲突，或使用-force或-旧式对等点重新尝试此命令，以接受不正确(且可能损坏的)依赖解决方案。

https://docs.npmjs.com/cli/v7/commands/npm-install for npm install for --force如下(npm ci的https://docs.npmjs.com/cli/v7/commands/npm-ci上没有标志)：

即使磁盘上存在本地副本，-f或- force参数也将强制npm获取远程资源。

同时，--legacy-peer-deps的文档说：

-遗留-对等程序:在安装时忽略所有peerDependencies，采用npm版本4到版本6的样式。

这两个标志似乎都可以让npm ci生成node_modules目录，而不存在任何问题，但我仍然不清楚两者之间的区别。

据我所知，--force听起来像是在最后一次依赖-下载-胜利的基础上，并将覆盖任何以前下载的依赖项。同时，--legacy-peer-deps听起来似乎在安装过程中总是跳过对等依赖项(不管这些依赖项是什么)，即使没有问题。

这两个旗子有什么区别，我们什么时候应该使用它们？

Answer 1

在新版本的npm (v7)中，默认情况下，npm install遇到冲突的peerDependencies时会失败。以前可不是这样的。

看看这里，了解更多关于npm v7中对等依赖关系的信息。

两者之间的差异如下-

• --legacy-peer-deps：在安装时忽略所有的peerDependencies，采用npm 4到version 6的风格。
• --strict-peer-deps：当遇到冲突的peerDependencies时，失败并中止安装过程。默认情况下，npm只会导致由根项目的直接依赖关系引起的peerDependencies冲突崩溃。
• --force：将强制npm获取远程资源，即使磁盘上存在本地副本。

Answer 2

在https://github.blog/2021-02-02-npm-7-is-now-generally-available/一文中，

您可以选择使用--force重试以绕过冲突或--legacy-peer-deps命令来完全忽略对等依赖(此行为类似于版本4-6)。

我同意这句话并不是很清楚，但是“完全忽略对等依赖”听起来不太好。让我们使用一个真实的例子：

以下是我在npm install时遇到的对等依赖错误

npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR!
npm ERR! While resolving: mobile@undefined
npm ERR! Found: react@17.0.1
npm ERR! node_modules/react
npm ERR!   react@"17.0.1" from the root project
npm ERR!   peer react@">=16.0.0" from @testing-library/react-native@7.2.0
npm ERR!   node_modules/@testing-library/react-native
npm ERR!     dev @testing-library/react-native@"7.2.0" from the root project
npm ERR!
npm ERR! Could not resolve dependency:
npm ERR! peer react@"16.13.1" from react-native@0.63.2
npm ERR! node_modules/react-native
npm ERR!   react-native@"https://github.com/expo/react-native/archive/sdk-39.0.4.tar.gz" from the root project
npm ERR!   peer react-native@">=0.59" from @testing-library/react-native@7.2.0
npm ERR!   node_modules/@testing-library/react-native
npm ERR!     dev @testing-library/react-native@"7.2.0" from the root project
npm ERR!
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR!
npm ERR! See /Users/me/.npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/me/.npm/_logs/2021-03-13T00_10_33_813Z-debug.log
npm ERR! code 1
npm ERR! path /Users/me/my-app
npm ERR! command failed
npm ERR! command sh -c sh ./bin/setup.sh

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/me/.npm/_logs/2021-03-13T00_10_33_860Z-debug.log

下面是package-lock.json在--legacy-peer-deps和--force之间的区别。

1. 如果我运行npm install --legacy-peer-deps，它会在我的npm install --legacy-peer-deps中添加以下内容

"node_modules/@unimodules/react-native-adapter": {
  "version": "5.7.0",
  "resolved": "https://registry.npmjs.org/@unimodules/react-native-adapter/-/react-native-adapter-5.7.0.tgz",
  "integrity": "sha512-L557/+sc8ZKJVgo1734HF1QNCxrt/fpqdmdNgySJT+kErux/AJNfPq3flsK0fyJduVmniTutYIMyW48cFoPKDA==",
  "dependencies": {
    "invariant": "^2.2.4",
    "lodash": "^4.5.0"
  },
  "peerDependencies": {
    "react-native": "*",
    "react-native-web": "~0.13.7"
  }
},

...

"@unimodules/react-native-adapter": {
  "version": "5.7.0",
  "resolved": "https://registry.npmjs.org/@unimodules/react-native-adapter/-/react-native-adapter-5.7.0.tgz",
  "integrity": "sha512-L557/+sc8ZKJVgo1734HF1QNCxrt/fpqdmdNgySJT+kErux/AJNfPq3flsK0fyJduVmniTutYIMyW48cFoPKDA==",
  "requires": {
    "invariant": "^2.2.4",
    "lodash": "^4.5.0"
  }
},

1. 如果我使用npm install --force，则它会添加

"node_modules/expo/node_modules/@unimodules/react-native-adapter": {
  "version": "5.7.0",
  "resolved": "https://registry.npmjs.org/@unimodules/react-native-adapter/-/react-native-adapter-5.7.0.tgz",
  "integrity": "sha512-L557/+sc8ZKJVgo1734HF1QNCxrt/fpqdmdNgySJT+kErux/AJNfPq3flsK0fyJduVmniTutYIMyW48cFoPKDA==",
  "dependencies": {
    "invariant": "^2.2.4",
    "lodash": "^4.5.0"
  },
  "peerDependencies": {
    "react-native": "*",
    "react-native-web": "~0.13.7"
  }
},
"node_modules/expo/node_modules/inline-style-prefixer": {
  "version": "5.1.2",
  "resolved": "https://registry.npmjs.org/inline-style-prefixer/-/inline-style-prefixer-5.1.2.tgz",
  "integrity": "sha512-PYUF+94gDfhy+LsQxM0g3d6Hge4l1pAqOSOiZuHWzMvQEGsbRQ/ck2WioLqrY2ZkHyPgVUXxn+hrkF7D6QUGbA==",
  "peer": true,
  "dependencies": {
    "css-in-js-utils": "^2.0.0"
  }
},
"node_modules/expo/node_modules/react-native-web": {
  "version": "0.13.18",
  "resolved": "https://registry.npmjs.org/react-native-web/-/react-native-web-0.13.18.tgz",
  "integrity": "sha512-WR/0ECAmwLQ2+2cL2Ur+0/swXFAtcSM0URoADJmG6D4MnY+wGc91JO8LoOTlgY0USBOY+qG/beRrjFa+RAuOiA==",
  "peer": true,
  "dependencies": {
    "array-find-index": "^1.0.2",
    "create-react-class": "^15.6.2",
    "deep-assign": "^3.0.0",
    "fbjs": "^1.0.0",
    "hyphenate-style-name": "^1.0.3",
    "inline-style-prefixer": "^5.1.0",
    "normalize-css-color": "^1.0.2",
    "prop-types": "^15.6.0",
    "react-timer-mixin": "^0.13.4"
  },
  "peerDependencies": {
    "react": ">=16.5.1",
    "react-dom": ">=16.5.1"
  }
},

...

  "dependencies": {
    "@unimodules/react-native-adapter": {
      "version": "5.7.0",
      "resolved": "https://registry.npmjs.org/@unimodules/react-native-adapter/-/react-native-adapter-5.7.0.tgz",
      "integrity": "sha512-L557/+sc8ZKJVgo1734HF1QNCxrt/fpqdmdNgySJT+kErux/AJNfPq3flsK0fyJduVmniTutYIMyW48cFoPKDA==",
      "requires": {
        "invariant": "^2.2.4",
        "lodash": "^4.5.0"
      }
    },
    "inline-style-prefixer": {
      "version": "5.1.2",
      "resolved": "https://registry.npmjs.org/inline-style-prefixer/-/inline-style-prefixer-5.1.2.tgz",
      "integrity": "sha512-PYUF+94gDfhy+LsQxM0g3d6Hge4l1pAqOSOiZuHWzMvQEGsbRQ/ck2WioLqrY2ZkHyPgVUXxn+hrkF7D6QUGbA==",
      "peer": true,
      "requires": {
        "css-in-js-utils": "^2.0.0"
      }
    },
    "react-native-web": {
      "version": "0.13.18",
      "resolved": "https://registry.npmjs.org/react-native-web/-/react-native-web-0.13.18.tgz",
      "integrity": "sha512-WR/0ECAmwLQ2+2cL2Ur+0/swXFAtcSM0URoADJmG6D4MnY+wGc91JO8LoOTlgY0USBOY+qG/beRrjFa+RAuOiA==",
      "peer": true,
      "requires": {
        "array-find-index": "^1.0.2",
        "create-react-class": "^15.6.2",
        "deep-assign": "^3.0.0",
        "fbjs": "^1.0.0",
        "hyphenate-style-name": "^1.0.3",
        "inline-style-prefixer": "^5.1.0",
        "normalize-css-color": "^1.0.2",
        "prop-types": "^15.6.0",
        "react-timer-mixin": "^0.13.4"
      }
    }
  }
},

正如您所看到的，npm install --force仍然支持许多更严格的依赖版本。

Answer 3

对于那些想知道哪个更安全的人，答案是--force

--legacy-peer-deps完全忽略对等依赖关系，这可能会破坏您的依赖关系解决方案。

另一方面，--force只是为冲突的依赖项设置了一个不同的对等依赖版本。

使用强制并不总是理想的，因为每个依赖版本都会占用额外的空间。使用强制与许多依赖关系将增加您的总空间需求，一个不错的数量。