fix(core): omit peer dependencies when installing packages to a temp dir

[FrozenPandaz]

Current Behavior

installPackageToTmp (behind devkit's ensurePackage) fetches a package into an empty temp directory. npm and bun auto-install that package's peer dependencies there. So a loose peer range — e.g. @phenomnomnominal/tsquery's typescript: >3.0.0 — pulls the newest major, TypeScript 7, into the temp dir. tsquery reads ts.SyntaxKind at module load, which TS 7 no longer exposes as a top-level CommonJS export, so it crashes:

 NX   Cannot convert undefined or null to object
    at Object.keys (<anonymous>)
    at .../@phenomnomnominal/tsquery/dist/src/syntax-kind.js:8:27

Expected Behavior

Peer dependencies are the host's responsibility, not something a throwaway fetch should decide. ensurePackage already loads the package from the temp dir with the workspace's node_modules on NODE_PATH, so its peers resolve from the workspace — the correct provider. This omits peers from the temp install so nothing incompatible gets pulled:

• npm / bun: --omit=peer
• pnpm: --config.auto-install-peers=false
• Yarn (classic & Berry): never auto-installs peers, so no flag needed

Verified locally: with --omit=peer the temp dir no longer contains TypeScript 7, and loading the package resolves typescript@6.0.3 from the workspace via NODE_PATH. Unit tests cover the emitted install command for every package manager.

Related Issue(s)

Hardening for the ensurePackage path, surfaced while investigating the TypeScript 7 / tsquery crash. Complements bounding tsquery's typescript peer range at the source.

---

View session information ↗

[netlify]

✅ Deploy Preview for nx-dev ready!

Name	Link
🔨 Latest commit	8736030
🔍 Latest deploy log	https://app.netlify.com/projects/nx-dev/deploys/6a510ecae1253b000795da6b
😎 Deploy Preview	https://deploy-preview-36295--nx-dev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview for nx-docs ready!

Name	Link
🔨 Latest commit	8736030
🔍 Latest deploy log	https://app.netlify.com/projects/nx-docs/deploys/6a510ecae9ebb80008e48da8
😎 Deploy Preview	https://deploy-preview-36295--nx-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 8736030

Command	Status	Duration	Result
nx affected --targets=lint,test,build,e2e,e2e-c...	✅ Succeeded	6m 38s	View ↗
nx run-many -t check-imports check-lock-files c...	✅ Succeeded	4s	View ↗
nx-cloud record -- pnpm nx-cloud conformance:check	✅ Succeeded	1m 4s	View ↗
nx build workspace-plugin	✅ Succeeded	<1s	View ↗
nx-cloud record -- nx sync:check	✅ Succeeded	19s	View ↗
nx-cloud record -- nx format:check	✅ Succeeded	7s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-07-10 18:17:35 UTC

[nx-cloud]

Important

At least one additional CI pipeline execution has run since the conclusion below was written and it may no longer be applicable.

Nx Cloud is proposing a fix for your failed CI:

We add installMissingPeersToTmpDir to ensurePackage to fix the regression introduced by omitting all peer deps from the temp-dir install. Peers already present in the workspace continue to resolve via NODE_PATH (preserving the original fix that prevents TypeScript 7 from shadowing the workspace version), while peers absent from the workspace — such as webpack during a fresh create-nx-workspace --preset=express — are now installed directly into the temp dir so require('webpack') inside @nx/webpack succeeds at module load time.

Warning

❌ We could not verify this fix.

Suggested Fix changes

diff --git a/packages/devkit/src/utils/package-json.ts b/packages/devkit/src/utils/package-json.ts
index a17ec79d..787a07dd 100644
--- a/packages/devkit/src/utils/package-json.ts
+++ b/packages/devkit/src/utils/package-json.ts
@@ -1,8 +1,10 @@
+import { execSync } from 'child_process';
 import { existsSync } from 'fs';
 import { Module } from 'module';
 import {
   detectPackageManager,
   type GeneratorCallback,
+  getPackageManagerCommand,
   output,
   readJson,
   readJsonFile,
@@ -915,6 +917,14 @@ export function ensurePackage<T extends any = any>(
     detectPackageManager(workspaceRoot)
   );
 
+  // Peers that ARE in the workspace will be served via NODE_PATH below, so the
+  // temp-dir install skips them (preventing an incompatible version from being
+  // pulled in). Peers that are NOT in the workspace (e.g. `webpack` in a fresh
+  // express workspace before its first install) must be installed into the temp
+  // dir now, otherwise `require('webpack')` inside @nx/webpack will fail at
+  // module load time.
+  installMissingPeersToTmpDir(pkg, tempDir, workspaceRoot);
+
   addToNodePath(join(workspaceRoot, 'node_modules'));
   addToNodePath(join(tempDir, 'node_modules'));
 
@@ -942,6 +952,74 @@ export function ensurePackage<T extends any = any>(
   }
 }
 
+/**
+ * After a temp-dir install that omits peer dependencies, check whether any of
+ * the package's peers are absent from the workspace's node_modules.  Those
+ * missing peers must be installed into the temp dir directly so that
+ * `require('<peer>')` inside the package succeeds at module load time.
+ *
+ * Peers that *are* present in the workspace are intentionally left out of the
+ * temp dir — they resolve via NODE_PATH so the workspace version is used,
+ * which prevents an incompatible version (e.g. TypeScript 7 when the workspace
+ * uses TypeScript 6) from being pulled in.
+ */
+function installMissingPeersToTmpDir(
+  pkg: string,
+  tempDir: string,
+  workspaceRoot: string
+): void {
+  let peerDependencies: Record<string, string> = {};
+  try {
+    ({ peerDependencies = {} } = require(
+      require.resolve(`${pkg}/package.json`, { paths: [tempDir] })
+    ));
+  } catch {
+    return; // Can't read package.json — skip silently.
+  }
+
+  const peers = Object.entries(peerDependencies);
+  if (peers.length === 0) return;
+
+  // Identify peers that are not resolvable from the workspace.
+  const missingPeers = peers.filter(([peerPkg]) => {
+    try {
+      require.resolve(peerPkg, { paths: [workspaceRoot] });
+      return false; // Already in workspace — NODE_PATH will serve it.
+    } catch {
+      return true; // Absent from workspace — must be installed in temp dir.
+    }
+  });
+
+  if (missingPeers.length === 0) return;
+
+  const packageManager = detectPackageManager(workspaceRoot);
+  const pmCommands = getPackageManagerCommand(packageManager);
+  const isVerbose = process.env.NX_VERBOSE_LOGGING === 'true';
+  const execOptions = {
+    cwd: tempDir,
+    stdio: isVerbose ? ('inherit' as const) : ('ignore' as const),
+    windowsHide: true,
+    env: { ...process.env, YARN_ENABLE_SCRIPTS: 'false' },
+  };
+
+  for (const [peerPkg, peerRange] of missingPeers) {
+    try {
+      execSync(
+        [
+          pmCommands.addDev,
+          `${peerPkg}@"${peerRange}"`,
+          pmCommands.ignoreScriptsFlag,
+        ]
+          .filter(Boolean)
+          .join(' '),
+        execOptions
+      );
+    } catch {
+      // Best-effort: if a peer can't be installed, continue.
+    }
+  }
+}
+
 function addToNodePath(dir: string) {
   // NODE_PATH is a delimited list of paths.
   // The delimiter is different for windows.

  

Or Apply changes locally with:

npx nx-cloud apply-locally anyh-38EH

Apply fix locally with your editor ↗   View interactive diff ↗

_{🎓 Learn more about Self-Healing CI on nx.dev}