fix: prune optional peer dependencies that are no longer explicitly depended on (#8431)

Currently optional peer dependencies are retained so long as at least
one package in the tree has them as an optional peer dependency, meaning
once added they become non-optional even though `npm` does actually seem
to mark such dependencies.

To resolve this, I've modified the pruning logic to check for nodes that
are both `optional` and `peer`, in addition to `extraneous` nodes.

Resolves #4737

Author: G-Rath

workspaces/arborist/lib/arborist/build-ideal-tree.js

@@ -1511,7 +1511,12 @@ This is a one-time fix-up, please be patient...
 
   #idealTreePrune () {
     for (const node of this.idealTree.inventory.values()) {
-      if (node.extraneous) {
+      // optional peer dependencies are meant to be added to the tree
+      // through an explicit required dependency (most commonly in the
+      // root package.json), at which point they won't be optional so
+      // any dependencies still marked as both optional and peer at
+      // this point can be pruned as a special kind of extraneous
+      if (node.extraneous || (node.peer && node.optional)) {
         node.parent = null
       }
     }

workspaces/arborist/tap-snapshots/test/arborist/pruner.js.test.cjs

@@ -124,6 +124,82 @@ ArboristNode {
 }
 `
 
+exports[`test/arborist/pruner.js TAP prune with lockfile with implicit optional peer dependencies > should remove all deps from reified tree 1`] = `
+ArboristNode {
+  "children": Map {
+    "dedent" => ArboristNode {
+      "edgesIn": Set {
+        EdgeIn {
+          "from": "",
+          "name": "dedent",
+          "spec": "^1.6.0",
+          "type": "prod",
+        },
+      },
+      "edgesOut": Map {
+        "babel-plugin-macros" => EdgeOut {
+          "name": "babel-plugin-macros",
+          "spec": "^3.1.0",
+          "to": null,
+          "type": "peerOptional",
+        },
+      },
+      "location": "node_modules/dedent",
+      "name": "dedent",
+      "path": "{CWD}/test/arborist/tap-testdir-pruner-prune-with-lockfile-with-implicit-optional-peer-dependencies/node_modules/dedent",
+      "resolved": "https://registry.npmjs.org/dedent/-/dedent-1.6.0.tgz",
+      "version": "1.6.0",
+    },
+  },
+  "edgesOut": Map {
+    "dedent" => EdgeOut {
+      "name": "dedent",
+      "spec": "^1.6.0",
+      "to": "node_modules/dedent",
+      "type": "prod",
+    },
+  },
+  "isProjectRoot": true,
+  "location": "",
+  "name": "tap-testdir-pruner-prune-with-lockfile-with-implicit-optional-peer-dependencies",
+  "packageName": "prune-lockfile-optional-peer",
+  "path": "{CWD}/test/arborist/tap-testdir-pruner-prune-with-lockfile-with-implicit-optional-peer-dependencies",
+  "version": "1.0.0",
+}
+`
+
+exports[`test/arborist/pruner.js TAP prune with lockfile with implicit optional peer dependencies > should remove optional peer dependencies in package-lock.json 1`] = `
+Object {
+  "lockfileVersion": 3,
+  "name": "prune-lockfile-optional-peer",
+  "packages": Object {
+    "": Object {
+      "dependencies": Object {
+        "dedent": "^1.6.0",
+      },
+      "name": "prune-lockfile-optional-peer",
+      "version": "1.0.0",
+    },
+    "node_modules/dedent": Object {
+      "integrity": "sha512-F1Z+5UCFpmQUzJa11agbyPVMbpgT/qA3/SKyJ1jyBgm7dUcUEa8v9JwDkerSQXfakBwFljIxhOJqGkjUwZ9FSA==",
+      "license": "MIT",
+      "peerDependencies": Object {
+        "babel-plugin-macros": "^3.1.0",
+      },
+      "peerDependenciesMeta": Object {
+        "babel-plugin-macros": Object {
+          "optional": true,
+        },
+      },
+      "resolved": "https://registry.npmjs.org/dedent/-/dedent-1.6.0.tgz",
+      "version": "1.6.0",
+    },
+  },
+  "requires": true,
+  "version": "1.0.0",
+}
+`
+
 exports[`test/arborist/pruner.js TAP prune workspaces > must match snapshot 1`] = `
 ArboristNode {
   "children": Map {

workspaces/arborist/test/arborist/pruner.js

@@ -38,6 +38,36 @@ t.test('prune with lockfile', async t => {
   t.matchSnapshot(printTree(tree))
 })
 
+t.test('prune with lockfile with implicit optional peer dependencies', async t => {
+  registry.audit({})
+  const opts = {}
+
+  // todo: for some reason on Windows when doing this test NPM looks for
+  //   the cache in the home directory, resulting in an unexpected real
+  //   call being made to the registry
+  if (process.platform === 'win32') {
+    opts.cache = 'C:\\npm\\cache\\_cacache'
+  }
+
+  const path = fixture(t, 'prune-lockfile-optional-peer')
+  const tree = await pruneTree(path, opts)
+
+  const dep = tree.children.get('dedent')
+  t.ok(dep, 'required prod dep was pruned from tree')
+
+  const optionalPeerDep = tree.children.get('babel-plugin-macros')
+  t.notOk(optionalPeerDep, 'all listed optional peer deps pruned from tree')
+
+  t.matchSnapshot(
+    require(path + '/package-lock.json'),
+    'should remove optional peer dependencies in package-lock.json'
+  )
+  t.matchSnapshot(
+    printTree(tree),
+    'should remove all deps from reified tree'
+  )
+})
+
 t.test('prune with actual tree omit dev', async t => {
   const path = fixture(t, 'prune-actual-omit-dev')
   const tree = await pruneTree(path, { omit: ['dev'] })