fix(deps): exclude @types/* packages from component peer dependencies by davidfirst · Pull Request #10186 · teambit/bit

davidfirst · 2026-02-05T01:15:19Z

When @types/* packages are listed as peers in env.jsonc, they were incorrectly being added to components' peer dependencies.

The fix excludes @types/* packages from component dependencies entirely when they're in the env's peers. This is correct because:

When a component is installed, its env is installed alongside it
Packages in env.jsonc peers become runtime dependencies of the env itself
Since @types/* packages are only needed for TypeScript compilation (handled by the env), components don't need them in their own dependencies

Why the blast radius is small

A package listed as an env peer is only attached to a component if the component actually imports it. @types/* packages are never imported directly in code, so an env's @types/* peer on its own never reaches a component.

A @types/foo becomes a component dependency only when it's present in the repo's workspace.jsonc (or a component's model) and the base foo package is imported — then it's auto-detected as a dev dependency, which this change keeps out of the component's peers.

So this only affects repos that put @types/* in their own workspace.jsonc (such as this one). The vast majority of users don't, so their components are unaffected.

When @types/* packages are listed as peers in env.jsonc, they should not be added to components' peer dependencies. The env is installed alongside the component and handles TypeScript compilation, so these type packages are already available without the component needing them directly.

Copilot

Pull request overview

This PR fixes an issue where @types/* packages listed as peer dependencies in env.jsonc were incorrectly being added to components' peer dependencies. Since these TypeScript type definition packages are only needed for compilation (handled by the environment), and the env is always installed alongside components, there's no need for components to declare them as their own dependencies.

Changes:

Added logic to exclude @types/* packages from component dependencies when they appear in env peer dependencies
Includes comprehensive inline documentation explaining the rationale

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

sonarqubecloud · 2026-02-06T13:00:04Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

qodo-free-for-open-source-projects · 2026-06-10T21:18:53Z

Code Review by Qodo

🐞 Bugs (3) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Stale missing @types issue 🐞 Bug ≡ Correctness

Description

handlePeerDependencyOverride() removes @types/* packages from the component dependency maps and
returns early, but does not remove the same package from an already-populated
MissingPackagesDependenciesOnFs issue. This can incorrectly keep the component in a tag-blocking
“missing packages” state even though @types/* was intentionally excluded from the component
dependencies.

Code

scopes/dependencies/dependencies/dependencies-loader/apply-overrides.ts[R661-670]

+    // @types/* packages should not be added to components at all when in env peers.
+    // When a component is installed in a workspace, its env is installed as well.
+    // Packages listed as peers in env.jsonc become runtime dependencies of the env itself,
+    // so they're always installed alongside the env. Since @types/* packages are only needed
+    // for TypeScript compilation (which the env handles), there's no need for components
+    // to have them in their own dependencies.
+    if (pkgName.startsWith('@types/')) {
+      delete this.allPackagesDependencies.peerPackageDependencies[pkgName];
+      return true;
+    }

Evidence
The new @types/* early-return path removes the dependency from dependency maps, but nothing updates
the missing-packages issue list. Missing packages are recorded into MissingPackagesDependenciesOnFs
during auto-detection and then propagated onto component.issues, which is used by status/tag flows;
leaving stale entries can therefore incorrectly mark the component as having tag-blocking issues.
scopes/dependencies/dependencies/dependencies-loader/apply-overrides.ts[653-670]
scopes/dependencies/dependencies/dependencies-loader/auto-detect-deps.ts[741-752]
scopes/dependencies/dependencies/dependencies-loader/dependencies-loader.ts[155-171]
components/component-issues/component-issue.ts[17-23]
scopes/component/status/status.main.runtime.ts[145-172]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
When env peers include an `@types/*` package, `handlePeerDependencyOverride()` deletes the dependency entries and returns early. If `MissingPackagesDependenciesOnFs` already contains that `@types/*` package (e.g. the env hasn't been installed yet), the issue remains on the component even though the dependency was intentionally removed, potentially blocking tag.
### Issue Context
- `MissingPackagesDependenciesOnFs` is a tag-blocking issue by default.
- Current logic removes `@types/*` from `allPackagesDependencies` only, without cleaning existing issues data.
### Fix Focus Areas
- scopes/dependencies/dependencies/dependencies-loader/apply-overrides.ts[653-684]
### Suggested fix
- In `handlePeerDependencyOverride()`, before returning `true` for `@types/*`, remove `pkgName` from `MissingPackagesDependenciesOnFs` issue data:
- Filter `missingPackages` arrays to exclude `pkgName`
- Drop entries where `missingPackages` becomes empty
- If the issue data array becomes empty, delete the issue entirely (`this.issues.delete(IssuesClasses.MissingPackagesDependenciesOnFs)`)
- Keep the deletion from `allPackagesDependencies.*` as-is.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. React17 forced to React19 🐞 Bug ≡ Correctness

Description

workspace.jsonc introduces pnpm overrides that force dependencies requesting react@17/react-dom@17
to resolve to 19.1.0, changing dependency resolution semantics across the entire repo. This can
break older published components/packages that actually require React 17 behavior, and it is
unrelated to the PR’s stated goal (excluding @types/* from component peers).

Code

workspace.jsonc[R711-716]

+      // Collapse react/react-dom to a single version in capsules. Some older published
+      // components still pull react@17.0.2; without this, @teambit/logger resolves into two
+      // pnpm variants (_react@17.0.2 and _react@19.1.0) whose Logger types are incompatible
+      // (TS2345 "separate declarations of a private property 'extensionName'") and the build fails.
+      "react@17": "19.1.0",
+      "react-dom@17": "19.1.0",

Evidence

The workspace dependency resolver config now explicitly forces any react@17 / react-dom@17
resolution to 19.1.0 using pnpm overrides, which affects installation/hoisting across the
workspace and capsules.

workspace.jsonc[711-716]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`workspace.jsonc` adds pnpm `overrides` that map `react@17` and `react-dom@17` to `19.1.0`. This is a repo-wide behavioral change to dependency resolution and can cause runtime/compatibility breakages for packages that genuinely require React 17.
## Issue Context
This PR is scoped to excluding `@types/*` packages from component peer dependencies derived from env.jsonc. The added React overrides increase the PR blast radius and can make it harder to reason about regressions.
## Fix Focus Areas
- workspace.jsonc[711-716]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

3. @types peer overrides dropped 🐞 Bug ≡ Correctness

Description

handlePeerDependencyOverride() skips any @types/* entry found under auto-detected peerDependencies
overrides, which prevents those packages from ever being added to the component dependency fields.
Since autoDetectOverrides is built by merging env policies with variant/config and merge-config
policies, this can also drop explicitly-configured (non-env) @types/* peer overrides
unintentionally.

Code

scopes/dependencies/dependencies/dependencies-loader/apply-overrides.ts[R661-670]

+    // @types/* packages should not be added to components at all when in env peers.
+    // When a component is installed in a workspace, its env is installed as well.
+    // Packages listed as peers in env.jsonc become runtime dependencies of the env itself,
+    // so they're always installed alongside the env. Since @types/* packages are only needed
+    // for TypeScript compilation (which the env handles), there's no need for components
+    // to have them in their own dependencies.
+    if (pkgName.startsWith('@types/')) {
+      delete this.allPackagesDependencies.peerPackageDependencies[pkgName];
+      return true;
+    }

Evidence
The PR adds an unconditional early-return for @types/* in handlePeerDependencyOverride().
Separately, the code shows autoDetectOverrides comes from workspace.getAutoDetectOverrides(),
which explicitly merges env policies with variant/config and merge-config policies, and
mergeVariantPolicies() includes policies from component config as well; therefore the early-return
affects more than env.jsonc-derived peers.
scopes/dependencies/dependencies/dependencies-loader/apply-overrides.ts[247-254]
scopes/dependencies/dependencies/dependencies-loader/apply-overrides.ts[653-670]
scopes/workspace/workspace/workspace.ts[2638-2662]
scopes/dependencies/dependency-resolver/dependency-resolver.main.runtime.ts[1272-1313]
components/legacy/extension-data/extension-data-list.ts[161-191]
scopes/workspace/workspace/aspects-merger.ts[205-224]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`handlePeerDependencyOverride()` unconditionally skips adding `@types/*` packages when processing `autoDetectOverrides.peerDependencies`. But `autoDetectOverrides` is an aggregate of multiple policy sources (env + variants/config + merge-config). This makes the exclusion broader than “env.jsonc peers” and can silently ignore intentional `@types/*` peer policies coming from variants/merge-config.
### Issue Context
- The skip is implemented in `handlePeerDependencyOverride()`.
- `autoDetectOverrides` is populated from `workspace.getAutoDetectOverrides()`, which merges env policy with variant/config and merge-config.
### Fix Focus Areas
- scopes/dependencies/dependencies/dependencies-loader/apply-overrides.ts[247-254]
- scopes/dependencies/dependencies/dependencies-loader/apply-overrides.ts[653-670]
- scopes/workspace/workspace/workspace.ts[2638-2662]
- scopes/dependencies/dependency-resolver/dependency-resolver.main.runtime.ts[1272-1313]
### Suggested fix approach
- Restrict the `@types/*` exclusion to overrides originating from **env.jsonc peers** only.
- Prefer filtering at the source (env-policy-to-overrides conversion) rather than inside `ApplyOverrides`, so variant/merge-config peer policies can still apply.
- If source metadata is not available at this layer, consider extending the overrides data structure to preserve provenance for peer entries, or apply the filter before the policies are merged (when sources are still distinguishable).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

qodo-free-for-open-source-projects · 2026-06-11T11:38:48Z

Code review by qodo was updated up to the latest commit f67480f

qodo-free-for-open-source-projects · 2026-06-11T19:51:02Z

Code review by qodo was updated up to the latest commit f9964c2

qodo-free-for-open-source-projects · 2026-06-12T14:09:50Z

Code review by qodo was updated up to the latest commit 0176b9a

…rom-component-peers

qodo-free-for-open-source-projects · 2026-06-24T14:26:04Z

Code review by qodo was updated up to the latest commit 4004b33

qodo-free-for-open-source-projects · 2026-06-25T13:38:34Z

Code review by qodo was updated up to the latest commit ddfde6c

qodo-free-for-open-source-projects · 2026-06-26T13:22:54Z

Code review by qodo was updated up to the latest commit 6972bf2

qodo-free-for-open-source-projects · 2026-06-26T15:53:56Z

Code review by qodo was updated up to the latest commit 7ed4421

…eer-variant split

qodo-free-for-open-source-projects · 2026-06-26T17:51:37Z

Code review by qodo was updated up to the latest commit c224e06

Copilot AI review requested due to automatic review settings February 5, 2026 01:15

Copilot started reviewing on behalf of davidfirst February 5, 2026 01:15 View session

Copilot AI reviewed Feb 5, 2026

View reviewed changes

Comment thread scopes/dependencies/dependencies/dependencies-loader/apply-overrides.ts Outdated

davidfirst added 2 commits February 5, 2026 16:49

refactor(deps): extract helper methods to reduce cognitive complexity

c4637a1

Merge branch 'master' into fix/exclude-types-from-component-peers

a62dafc

Copilot AI review requested due to automatic review settings February 5, 2026 22:10

Copilot started reviewing on behalf of davidfirst February 5, 2026 22:10 View session

Copilot AI reviewed Feb 5, 2026

View reviewed changes

Comment thread scopes/dependencies/dependencies/dependencies-loader/apply-overrides.ts

Merge branch 'master' into fix/exclude-types-from-component-peers

7cb0f29

Merge branch 'master' into fix/exclude-types-from-component-peers

2016587

Copilot AI review requested due to automatic review settings June 10, 2026 12:30

Copilot started reviewing on behalf of davidfirst June 10, 2026 12:30 View session

Copilot AI reviewed Jun 10, 2026

View reviewed changes

test(deps): add e2e test for excluding @types/* from component peers

ef69ec4

GiladShoham approved these changes Jun 10, 2026

View reviewed changes

Merge branch 'master' into fix/exclude-types-from-component-peers

ec32978

Merge branch 'master' into fix/exclude-types-from-component-peers

f67480f

Merge branch 'master' into fix/exclude-types-from-component-peers

f9964c2

qodo-free-for-open-source-projects Bot reviewed Jun 11, 2026

View reviewed changes

Comment thread scopes/dependencies/dependencies/dependencies-loader/apply-overrides.ts

Merge branch 'master' into fix/exclude-types-from-component-peers

0176b9a

davidfirst added 2 commits June 23, 2026 09:32

Merge remote-tracking branch 'origin/master' into fix/exclude-types-f…

3651d5c

…rom-component-peers

Merge remote-tracking branch 'origin/master' into fix/exclude-types-f…

4004b33

…rom-component-peers

Merge branch 'master' into fix/exclude-types-from-component-peers

ddfde6c

Merge branch 'master' into fix/exclude-types-from-component-peers

6972bf2

davidfirst enabled auto-merge (squash) June 26, 2026 13:18

Merge branch 'master' into fix/exclude-types-from-component-peers

7ed4421

fix(deps): pin react/react-dom 17->19 in overrides to avoid capsule p…

c224e06

…eer-variant split

davidfirst merged commit 0bf89ad into master Jun 26, 2026
13 checks passed

davidfirst deleted the fix/exclude-types-from-component-peers branch June 26, 2026 18:30

Uh oh!

Conversation

davidfirst commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why the blast radius is small

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

sonarqubecloud Bot commented Feb 6, 2026

Quality Gate passed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

qodo-free-for-open-source-projects Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

qodo-free-for-open-source-projects Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qodo-free-for-open-source-projects Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

qodo-free-for-open-source-projects Bot commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qodo-free-for-open-source-projects Bot commented Jun 24, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Jun 25, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Jun 26, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Jun 26, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Jun 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

davidfirst commented Feb 5, 2026 •

edited

Loading

qodo-free-for-open-source-projects Bot commented Jun 10, 2026 •

edited

Loading

qodo-free-for-open-source-projects Bot commented Jun 11, 2026 •

edited

Loading

qodo-free-for-open-source-projects Bot commented Jun 11, 2026 •

edited

Loading

qodo-free-for-open-source-projects Bot commented Jun 12, 2026 •

edited

Loading