From 4394ef92dcce02f91d475cefe44d00ffc510d9df Mon Sep 17 00:00:00 2001 From: Adam Wright Date: Wed, 16 Sep 2026 17:27:55 +0000 Subject: [PATCH] chore: stop installing with --legacy-peer-deps It was on every install here -- CI, deploy, release verification, the Dockerfile, the local setup guide -- and the tree stopped needing it long ago. Measured 2026-09-16: `npm ci` on main resolves and installs strictly, 2109 packages, and a strict `npm install` leaves the lockfile untouched. It was not free while it stayed. It accepts an inconsistent tree, so a dependency bump that cannot resolve at all passed every check: Angular's packages peer-depend on one another at exact versions, dependabot's group moved eleven of them and left `platform-browser-dynamic` and `compiler-cli` behind, and CI was green. The only thing that objected was this repo's pre-push hook, which runs `npm ci` without the flag -- so the gate existed locally and not where it mattered. Removing it makes CI the check it was meant to be. A bump that cannot resolve now fails where it is raised rather than where someone happens to push from. CONTRIBUTING says why, so it is not added back the next time an install fails on peers. If an install fails on peer dependencies the tree is wrong; the fix is the versions, not telling npm to stop looking. Left alone deliberately: the Dockerfile still uses `npm install` rather than `npm ci`. Making container builds reproducible is worth doing and is a different change from this one. Co-Authored-By: Claude Opus 5 --- .github/workflows/deploy.yml | 2 +- .github/workflows/release-verification.yml | 2 +- .github/workflows/tests.yml | 4 ++-- CONTRIBUTING.md | 13 +++++++++++++ Dockerfile | 2 +- documentation/local-environment.md | 2 +- 6 files changed, 19 insertions(+), 6 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 25e2fe70..4f68f761 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -55,7 +55,7 @@ jobs: echo "Deploying to version $VERSION" - name: Install dependencies - run: npm ci --legacy-peer-deps + run: npm ci # site-search-index.json and the compiled content JSON are both generated # and gitignored. Without these the deployed bundle has no site-page diff --git a/.github/workflows/release-verification.yml b/.github/workflows/release-verification.yml index b46faad0..873b7af5 100644 --- a/.github/workflows/release-verification.yml +++ b/.github/workflows/release-verification.yml @@ -50,7 +50,7 @@ jobs: cache: npm - name: Install dependencies - run: npm ci --legacy-peer-deps + run: npm ci - name: Install Playwright browser run: npx playwright install --with-deps chromium diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 0aad8683..78b429e0 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -25,7 +25,7 @@ jobs: cache: npm - name: Install dependencies - run: npm ci --legacy-peer-deps + run: npm ci # No build step needed: no remaining spec imports the workspace libraries # from dist/, so this passes on a clean checkout. @@ -105,7 +105,7 @@ jobs: cache: npm - name: Install dependencies - run: npm ci --legacy-peer-deps + run: npm ci # src/styles.scss @use's all three of these from dist/, and the # pathway-browser build copies reactome-cytoscape-style's assets, so the diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 86dba755..8ab93bcf 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -63,6 +63,19 @@ error anywhere. breaks: anything read after the first `await` is not tracked as a dependency, so the effect never re-runs for it. Read signals up front, then do the async work. +**Do not add `--legacy-peer-deps`.** It was on every install here until +2026-09-16, left over from the first CI pipeline, and the tree had long since +stopped needing it -- `npm ci` resolves strictly today, 2109 packages, measured. + +What it cost while it stayed: a dependency bump that could not resolve at all +passed every check, because the flag accepts an inconsistent tree. Angular's +packages peer-depend on one another at exact versions, a group bump moved eleven +of them and left two behind, and nothing said so until a pre-push hook ran +`npm ci` without the flag. + +If an install fails on peer dependencies, the tree is wrong. Fix the versions +rather than telling npm to stop checking. + **The backend is local.** `proxy.conf.js` points at `http://localhost:8080`, where ContentService, AnalysisService and ExperimentDigester all run. Pointing it at `dev.reactome.org` instead sends every API call out through Cloudflare and diff --git a/Dockerfile b/Dockerfile index 46133c67..d287fec9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,7 +13,7 @@ COPY package*.json ./ RUN sed -i 's/ng serve/ng serve --host 0.0.0.0 --poll 2000/g' package.json # 4. Install Dependencies -RUN npm install --legacy-peer-deps --ignore-scripts +RUN npm install --ignore-scripts # The dev server runs against a bind-mounted working copy, so everything it # writes -- .angular/cache, generated content, dist -- lands in the developer's diff --git a/documentation/local-environment.md b/documentation/local-environment.md index 2b64ff04..100b24af 100644 --- a/documentation/local-environment.md +++ b/documentation/local-environment.md @@ -26,7 +26,7 @@ Node is the tool that will compile and run the Reactome project. You can downloa Once node is installed run the following commands in the `WebsiteAngular/` directory. ``` -npm install --legacy-peer-deps +npm install npm start ```