fix(core): omit peer dependencies when installing packages to a temp dir (#36295)

`installPackageToTmp` (behind devkit's `ensurePackage`) fetches a
package into an **empty** temp directory. npm and bun **auto-install
that package's peer dependencies** there. So a loose peer range — e.g.
`@phenomnomnominal/tsquery`'s `typescript: >3.0.0` — pulls the
**newest** major, TypeScript 7, into the temp dir. tsquery reads
`ts.SyntaxKind` at module load, which TS 7 no longer exposes as a
top-level CommonJS export, so it crashes:

```
 NX   Cannot convert undefined or null to object
    at Object.keys (<anonymous>)
    at .../@phenomnomnominal/tsquery/dist/src/syntax-kind.js:8:27
```

Peer dependencies are the **host's** responsibility, not something a
throwaway fetch should decide. `ensurePackage` already loads the package
from the temp dir with the workspace's `node_modules` on `NODE_PATH`, so
its peers resolve from the workspace — the correct provider. This omits
peers from the temp install so nothing incompatible gets pulled:

- **npm** / **bun**: `--omit=peer`
- **pnpm**: `--config.auto-install-peers=false`
- **Yarn** (classic & Berry): never auto-installs peers, so no flag
needed

Verified locally: with `--omit=peer` the temp dir no longer contains
TypeScript 7, and loading the package resolves `typescript@6.0.3` from
the workspace via `NODE_PATH`. Unit tests cover the emitted install
command for every package manager.

Hardening for the `ensurePackage` path, surfaced while investigating the
TypeScript 7 / tsquery crash. Complements bounding tsquery's
`typescript` peer range at the source.

<!-- polygraph-session-start -->
---
[View session information
↗](https://app.trypolygraph.com/orgs/6a061dcb561c062131116eca/sessions/Migrate-nrwl-repos-to-nx-23.1.0-rc.0-b8c94700)
<!-- polygraph-session-end -->

(cherry picked from commit edc9212)

Author: FrozenPandaz

packages/nx/src/utils/package-json.spec.ts

@@ -98,11 +98,71 @@ describe('installPackageToTmp', () => {
 
     expect(execSyncSpy).toHaveBeenCalledTimes(1);
     expect(execSyncSpy.mock.calls[0][0]).toBe(
-      'pnpm add -Dw nx@latest --ignore-scripts'
+      'pnpm add -Dw nx@latest --config.auto-install-peers=false --ignore-scripts'
     );
 
     cleanup();
   });
+
+  it('should omit peer dependencies so peers resolve from the workspace, not the temp dir', () => {
+    const tempDir = mkdtempSync(join(tmpdir(), 'nx-install-test-'));
+    const cleanup = jest.fn(() =>
+      rmSync(tempDir, { recursive: true, force: true })
+    );
+    jest.spyOn(pacakgeManager, 'createTempNpmDirectory').mockReturnValue({
+      dir: tempDir,
+      cleanup,
+    });
+    jest
+      .spyOn(pacakgeManager, 'getPackageManagerVersion')
+      .mockReturnValue('10.0.0');
+    jest.spyOn(pacakgeManager, 'getPackageManagerCommand').mockReturnValue({
+      addDev: 'npm install -D',
+      ignoreScriptsFlag: '--ignore-scripts',
+    } as any);
+    const execSyncSpy = jest
+      .spyOn(childProcess, 'execSync')
+      .mockReturnValue('' as any);
+
+    // npm: peers are omitted via `--omit=peer`
+    installPackageToTmp('@nx/cypress', '1.0.0', 'npm');
+    expect(execSyncSpy.mock.calls[0][0]).toBe(
+      'npm install -D @nx/cypress@1.0.0 --omit=peer --ignore-scripts'
+    );
+
+    // bun: also accepts `--omit=peer`
+    execSyncSpy.mockClear();
+    jest.spyOn(pacakgeManager, 'getPackageManagerCommand').mockReturnValue({
+      addDev: 'bun add -D',
+      ignoreScriptsFlag: undefined,
+    } as any);
+    installPackageToTmp('@nx/cypress', '1.0.0', 'bun');
+    expect(execSyncSpy.mock.calls[0][0]).toBe(
+      'bun add -D @nx/cypress@1.0.0 --omit=peer'
+    );
+
+    // pnpm: peers are omitted by disabling auto-install
+    execSyncSpy.mockClear();
+    jest.spyOn(pacakgeManager, 'getPackageManagerCommand').mockReturnValue({
+      addDev: 'pnpm add -Dw',
+      ignoreScriptsFlag: '--ignore-scripts',
+    } as any);
+    installPackageToTmp('@nx/cypress', '1.0.0', 'pnpm');
+    expect(execSyncSpy.mock.calls[0][0]).toBe(
+      'pnpm add -Dw @nx/cypress@1.0.0 --config.auto-install-peers=false --ignore-scripts'
+    );
+
+    // yarn: Berry does not auto-install peers, so no flag is added
+    execSyncSpy.mockClear();
+    jest.spyOn(pacakgeManager, 'getPackageManagerCommand').mockReturnValue({
+      addDev: 'yarn add -D',
+      ignoreScriptsFlag: undefined,
+    } as any);
+    installPackageToTmp('@nx/cypress', '1.0.0', 'yarn');
+    expect(execSyncSpy.mock.calls[0][0]).toBe('yarn add -D @nx/cypress@1.0.0');
+
+    cleanup();
+  });
 });
 
 describe('readTargetsFromPackageJson', () => {

packages/nx/src/utils/package-json.ts

@@ -384,9 +384,25 @@ function preparePackageInstallation(
   // it into the temp dir, so the `-w` here resolves to the temp dir.
   const pmCommands = getPackageManagerCommand(packageManager);
   const preInstallCommand = pmCommands.preInstall;
-  const installCommand = `${pmCommands.addDev} ${pkg}@${requiredVersion} ${
-    pmCommands.ignoreScriptsFlag ?? ''
-  }`;
+
+  // Omit peer dependencies from the temp install. `ensurePackage` puts the
+  // workspace's `node_modules` on `NODE_PATH`, so a loaded package resolves its
+  // peers from the workspace instead of pulling its own (possibly incompatible)
+  // copies into the temp dir.
+  const omitPeerDependenciesFlag =
+    packageManager === 'npm' || packageManager === 'bun'
+      ? '--omit=peer'
+      : packageManager === 'pnpm'
+        ? '--config.auto-install-peers=false'
+        : '';
+  const installCommand = [
+    pmCommands.addDev,
+    `${pkg}@${requiredVersion}`,
+    omitPeerDependenciesFlag,
+    pmCommands.ignoreScriptsFlag,
+  ]
+    .filter(Boolean)
+    .join(' ');
 
   const execOptions = {
     cwd: tempDir,