Publishing order should take peerDependencies into account

Currently the package graph ordering is defined in https://github.com/lerna/lerna/blob/bd799499c843c7b3c3e61386fa32ddc6e89bebc9/core/package-graph/index.js#L68 and only takes dependencies into account, and not peerDependencies. This means it is possible to publish a module with a peerDependency on a specific version that you are publishing at the same time, and the version with the peerDependency may be published before the version that it depends on.

Expected Behavior

Ideally the version ranges in the peerDependencies should be validated, and if the range is only satisfied by the version you are just about to publish, it should publish it later, after the dependency is publishes.

Context

Just noticed on Babel that @babel/cli was being published before @babel/core which means there is a period (which on this publish was about 4.5 minutes, since we publish a LOT of packages), where the CLI depends on a non-existent version of @babel/core because during our beta phase we’re using specific non-range peerDependencies. That gets extra dangerous once you take caching registry mirrors into account.

Your Environment

Executable	Version
lerna --version	2.0.0
npm --version	VERSION
yarn --version	1.6
node --version	6.12.3

[padraig-meaney]

@evocateur that sounds great to me. I may have some free bandwidth in the next 2 weeks to put together a PR for this.

[evocateur]

@sparebytes Yes, it is a best practice with npm packages (regardless of monorepo or not) to specify devDependencies for every member of peerDependencies.

@padraig-meaney I agree it’s unfortunate that proper peer+dev deps aren’t taken into account in lerna publish order. I would be open to a --graph-type flag whose value defaults to the current argument ("dependencies"), but with an optional "all" value that achieves what you’re looking for.

(as much as it’s tempting to automatically include devDependencies in the topological order if local peer + dev deps are detected, I feel that’s a bit too magical at this point)

# equivalent to current behavior
npx lerna publish --graph-type dependencies

# adds devDependencies to the package graph, thus influencing the topological sort
npx lerna publish --graph-type all

Configured in lerna.json:

{
  "command": {
    "publish": {
      "graphType": "all"
    }
  },
  "packages": [
    "packages/*"
  ],
  "version": "independent"
}

I’d be very interested in flipping the default in the next major, always adding devDependencies to the package graph for lerna publish (which is the default for literally every other command that topologically sorts the package graph, such as lerna exec and lerna run). There’s enough logging when circularity is encountered, and we could suggest --graph-type=dependencies as a (possible) fix for it.

Reopening to track the work.