peerDependenciesMeta for dependencies seems to be ignored

Describe the bug

When a project has a dependency, that in turn have peerDependenciesMeta for some of its dependencies set to { optional: true }, it seems like Stackblitz tries to load them anyway and crashes when not found.

Link to the blitz that caused the error

https://stackblitz.com/edit/superforms-2-testing-valibot-gdza6x

Steps to reproduce

Open the project

Expected behavior

Expected that the project should load as usual, displaying a form. Instead, it crashes:

Cannot find package 'zod' imported from /home/projects/superforms-2-testing-valibot-gdza6x/node_modules/zod-to-json-schema/dist/esm/parseDef.js
Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'zod' imported from /home/projects/superforms-2-testing-valibot-gdza6x/node_modules/zod-to-json-schema/dist/esm/parseDef.js
    at __node_internal_ (https://superforms2testingvalibotgdza6-jomf-36o0wd0p.w-credentialless.staticblitz.com/blitz.a9c8a5a3.js:36:5406)
    at new <anonymous> (https://superforms2testingvalibotgdza6-jomf-36o0wd0p.w-credentialless.staticblitz.com/blitz.a9c8a5a3.js:36:4168)
    at packageResolve (https://superforms2testingvalibotgdza6-jomf-36o0wd0p.w-credentialless.staticblitz.com/blitz.a9c8a5a3.js:114:9607)
    at https://superforms2testingvalibotgdza6-jomf-36o0wd0p.w-credentialless.staticblitz.com/blitz.a9c8a5a3.js:114:11305
    at defaultResolve (https://superforms2testingvalibotgdza6-jomf-36o0wd0p.w-credentialless.staticblitz.com/blitz.a9c8a5a3.js:114:12167)
    at nextResolve (https://superforms2testingvalibotgdza6-jomf-36o0wd0p.w-credentialless.staticblitz.com/blitz.a9c8a5a3.js:248:2120)
    at ESMLoader.resolve (https://superforms2testingvalibotgdza6-jomf-36o0wd0p.w-credentialless.staticblitz.com/blitz.a9c8a5a3.js:248:7556)
    at ESMLoader.getModuleJob (https://superforms2testingvalibotgdza6-jomf-36o0wd0p.w-credentialless.staticblitz.com/blitz.a9c8a5a3.js:248:4387)
    at https://superforms2testingvalibotgdza6-jomf-36o0wd0p.w-credentialless.staticblitz.com/blitz.a9c8a5a3.js:181:932
    at _0x3775c6.link (https://superforms2testingvalibotgdza6-jomf-36o0wd0p.w-credentialless.staticblitz.com/blitz.a9c8a5a3.js:352:381016)
    at https://superforms2testingvalibotgdza6-jomf-36o0wd0p.w-credentialless.staticblitz.com/blitz.a9c8a5a3.js:181:893

Parity with Local

[X] I have run the project in my local machine and I could not reproduce the issue.

Screenshots

No response

Platform

Win 10
Chrome 121.0.6167.161

Additional context

The package with peerDependenciesMeta is sveltekit-superforms@2.0.0-alpha.51.

    "peerDependencies": {
        "svelte": "3.x || 4.x || >=5.0.0-next.51",
        "@sveltejs/kit": "1.x || 2.x",
        "@sinclair/typebox": "^0.32.13",
        "arktype": "1.0.29-alpha",
        "joi": "^17.12.1",
        "superstruct": "^1.0.3",
        "valibot": "^0.28.1",
        "yup": "^1.3.3",
        "zod": "^3.22.4"
    },
    "peerDependenciesMeta": {
        "@sinclair/typebox": {
            "optional": true
        },
        "arktype": {
            "optional": true
        },
        "joi": {
            "optional": true
        },
        "superstruct": {
            "optional": true
        },
        "valibot": {
            "optional": true
        },
        "yup": {
            "optional": true
        },
        "zod": {
            "optional": true
        }
    },

I noticed that when updating to 2.0.0-alpha.52, which has the same peerDependencies also added as optionalDependencies, it works.

Hi @ciscoheat.

I’m looking at this project, but I haven't found a reason why zod should have been installed by npm install. This looks like a straightforward issue of:

The project requires the zod package (require chain is zod <- zod-to-json-schema <- sveltekit-superforms).
The zod package is not defined as a dependency of the root project or its dependencies (direct or transitive).

It looks like zod-to-json-schema is indeed declaring zod in its peerDependencies (non-optional), so there should be a warning about zod being an unsatisfied peer dependency, but because zod-to-json-schema is itself an optional peer dependency that warning gets suppressed?

The project code seems to be using the valibot adapter and not the zod adapter for sveltekit-superforms, so the question would be: what's going on in sveltekit-superforms that triggers it trying to require zod-to-json-schema?

So far I’m not convinced there's an issue in WebContainer, but who knows, maybe ^^

Hello, thanks for helping out, and good question about what's going on. :) Superforms is a form validation library (I'm the author), where you soon can pick from many different validation libraries (Zod, Valibot, Arktype, etc) for the data validation part.

I'd like to keep the installation procedure simple and clean, so if someone chooses Zod, installing it should ideally not be more than:

npm i -D sveltekit-superforms zod

The thing is though, that JSON schema is the underlying data model, so each supported library creates an extra dependency on a "to-json-schema" library. In Zod's case, zod-to-json-schema. So I've included these as optionalDependencies in package.json for sveltekit-superforms.

It seems like Vite/Rollup handles this well when you build the SvelteKit project, as long as the dependencies are ESM and tree-shakable they are only bundled when referenced. But somewhere with Stackblitz, things go wrong.

there should be a warning about zod being an unsatisfied peer dependency, but because zod-to-json-schema is itself an optional peer dependency that warning gets suppressed?

I've noticed that locally as well, not just on Stackblitz. I don't get a peer dependency warning for any library. If you have any ideas I'd be very grateful, maybe I've configured it incorrectly somewhere. Here's the latest package.json if you want to take a look.

I get the exact same issue on local so it's definitely not WebContainer.

In the screenshot you can see that zod-to-json-schema andsveltekit-superforms both try to load zod. I think somewhere, there's a check missing or some treeshaking isn't handled correctly.

I'm closing this issue as there is no action we can take here. Feel free to keep discussing the issue you are running into.

stackblitz / webcontainer-core