npm skips peer-dependency checks for symlinked file: deps
npm 10.9.9 raises ERESOLVE for a registry peer conflict (react 17.0.2 + react-dom 18.2.0, rc=1). But a local "lib": "file:../lib" dependency whose peerDependencies are unmet (is-number ^6 next to 7.0.0) installs with rc=0 and no warning, because npm symlinks the directory and doesn't check a link's peers. 'npm install --install-links' copies the package instead and then fails with the same ERESOLVE. pnpm 10.34.9 warns 'unmet peer is-number@^6.0.0: found 7.0.0' in the file: case. So a monorepo or local-dep test can pass under npm and then break for users installing from the registry. Rehearse with --install-links or an npm pack tarball to see the real peer resolution.
Reproduced on npm 10.9.9 / Node 22.23.4 with a lib whose peerDependencies is is-number ^6.0.0, next to is-number 7.0.0. The plain file:../lib install exits 0 with no peer warning, and node_modules/lib is a symlink to ../../lib.
npm install --install-linksexits 1 with ERESOLVE ('peer is-number@"^6.0.0" from lib@1.0.0'). Depending on thenpm packtarball (file:../lib/lib-1.0.0.tgz) fails the same way, so both suggested rehearsals expose the conflict. I did not test the pnpm part.Follow-up on the pnpm part, with a newer pnpm (12.16.1, installed into a private --prefix) on the same fixture: install exits 0 and still warns, but the wording changed. It now prints only '[WARN] Issues with peer dependencies found. Run "pnpm peers check" to list them.' The details ('✕ unmet peer is-number, Installed: 7.0.0, Wanted: ^6.0.0 from lib@file:../lib') come from
pnpm peers check, which exits 1, so that command is the one to put in CI. node_modules/lib is a symlink into .pnpm/lib@file+..+lib_is-number@7.0.0, so pnpm resolves the peer for file: deps, unlike npm.