Properly deal with transitive dependencies.

[stphane]

My NestJs application imports @nestjs/schedule which depends on "cron" pacakage. My own code relies on few constructors from "cron" package so I added a direct dependency on "cron" package. For my code to perfectly align with the right API and types, I had to lookup the version required in @nestjs/schedule and pin that exact version as a root dependency (which was not necessary with NPM thanks/due to "shameful" hoisting I guess).
⋄ What is the proper way to cope with transitive dependencies ?
⋄ Are root dependency + manual version pinning inescapable? Or is there some easier/cleaner way out ?
Thank you for your guidance.

[zkochan]

It shouldn't matter what version you install. If it needs to "perfectly align with the right API and types", then it probably needs to be a peer dependency.

[stphane]

Context

---

NestJs documentation suggests simply importing "cron"

Warning: [...] Import CronJob from the cron package.

but this is not enough for the package resolution to work when using PNPM apparently.
I may be wrong but I see no such recommendation as adding cron package as a dependency. I guess the doc was written with NPM hoisting in mind.

Adding cron package to "dependencies" while specifying a version not strictly equal to the one installed for nestjs/schedule (using same major and even minor component, tested 3.1.9 and 3.2.0) and passing my own cron objects to nestjs/schedule APIs ...

import { CronExpression, SchedulerRegistry } from '@nestjs/schedule';
import { CronJob } from "cron";
// ...
const actionsJob = new CronJob(/* ... */);
// ...      
this.schedulerRegistry.addCronJob('SomeTag', actionsJob);

... leads to the TSC error "Types have separate declarations of a private property"

Argument of type 
  'import("projects/node_modules/.pnpm/[email protected]/node_modules/cron/dist/job").CronJob<null, null>'
is not assignable to parameter of type
  'import("projects/node_modules/.pnpm/[email protected]/node_modules/cron/dist/job").CronJob<null, null>'.
    Types of property 'cronTime' are incompatible.
    Type 
         'import("projects/node_modules/.pnpm/[email protected]/node_modules/cron/dist/time").CronTime'
    is not assignable to type 
         'import("projects/node_modules/.pnpm/[email protected]/node_modules/cron/dist/time").CronTime'.
        Types have separate declarations of a private property 'second'.
--> this.schedulerRegistry.addCronJob('SomeTag', actionsJob); <--

We have pinned to the exact same version since no other scenario seem to work.
Now It is not clear to me what is the best_practice/recommended action I should take to properly handle the issue.

[zkochan]

If that's the only way it works, then it should be a peer dependency. It is a nestjs issue. On your side, you could use a readPackage hook to convert the dep to a peer dep (https://pnpm.io/pnpmfile#hooksreadpackagepkg-context-pkg--promisepkg). You will still need to install it as a dependency of your project. That's the only way your project will work with pnpm (or Yarn Plug'n'Play).

[stphane]

Again, thank you for your guidance.
Before closing this thread I have another question not directly related the initial topic:
Q. When managing node versions with pnpm env use --global, is there a way to tell which version of node was used to install a specific global package ?

[zkochan]

You can check the package.json of the global package. <pnpm root -g>/../package.json. In the dependenciesMeta field.