[Bug?]: Duplicated same-version packages in node_modules but not in yarn.lock

[valeriangalliat]

Self-service

• I'd be willing to implement a fix

Describe the bug

When installing eslint-config-next, eslint-plugin-import and @typescript-eslint/parser at the same time, eslint-plugin-import is duplicated inside node_modules:

node_modules/eslint-plugin-import
node_modules/eslint-config-next/node_modules/eslint-plugin-import

Despite the same version being installed in both:

$ yarn why eslint-plugin-import
├─ eslint-config-next@npm:14.2.5
│  └─ eslint-plugin-import@npm:2.29.1 (via npm:^2.28.1)
│
├─ eslint-config-next@npm:14.2.5 [ee419]
│  └─ eslint-plugin-import@npm:2.29.1 [ac8eb] (via npm:^2.28.1 [ac8eb])
│
└─ yarn-debug@workspace:.
   └─ eslint-plugin-import@npm:2.29.1 [ee419] (via npm:^2.29.1 [ee419])

$ yarn why -R eslint-plugin-import
└─ yarn-debug@workspace:.
   ├─ eslint-config-next@npm:14.2.5 [ee419] (via npm:^14.2.5 [ee419])
   │  └─ eslint-plugin-import@npm:2.29.1 [ac8eb] (via npm:^2.28.1 [ac8eb])
   └─ eslint-plugin-import@npm:2.29.1 [ee419] (via npm:^2.29.1 [ee419])

This does not happen if @typescript-eslint/parser is not installed. Without @typescript-eslint/parser, there's only one instance of eslint-plugin-import in node_modules/eslint-plugin-import.

---

ESLint issue that can result from this duplication:

ESLint couldn't determine the plugin "import" uniquely.

- node_modules/eslint-config-next/node_modules/eslint-plugin-import/lib/index.js (loaded in ".eslintrc.js » eslint-config-next/core-web-vitals » node_modules/eslint-config-next/index.js")
- node_modules/eslint-plugin-import/lib/index.js (loaded in ".eslintrc.js")

Please remove the "plugins" setting from either config or remove either plugin installation.

---

Related: #4128

To reproduce

yarn init -2
yarn add eslint-config-next eslint-plugin-import @typescript-eslint/parser

Environment

System:
    OS: macOS 14.5
    CPU: (10) arm64 Apple M1 Pro
  Binaries:
    Node: 18.20.3
    Yarn: 4.4.0
    npm: 10.7.0

Additional context

No response

[larixer]

@valeriangalliat Thank you for this report. So, what's going on is that there are actually two different copies of eslint-plugin-import that use two different sets of dependencies, you can see this by executing:
yarn info -R --virtuals eslint-plugin-import
the output is:

...
│
├─ eslint-plugin-import@npm:2.29.1 [655c5]
│  ├─ Version: 2.29.1
│  │ 
│  └─ Peer dependencies
│     ├─ @types/eslint@* → ✘
│     ├─ @types/typescript-eslint__parser@* → ✘
│     ├─ @typescript-eslint/parser@* → npm:7.2.0 [655c5]
│     └─ eslint@^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8 → ✘
│
└─ eslint-plugin-import@npm:2.29.1 [b6b48]
   ├─ Version: 2.29.1
   │ 
   └─ Peer dependencies
      ├─ @types/eslint@* → ✘
      ├─ @types/typescript-eslint__parser@* → ✘
      ├─ @typescript-eslint/parser@* → npm:8.1.0 [b6b48]
      └─ eslint@^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8 → ✘

So, two different @typescript-eslint/parser peer dependencies are used 7.2.0 and 8.1.0. The project root provides @typescript-eslint/parser@npm:8.1.0 and eslint-config-next provides: @typescript-eslint/parser@npm:7.2.0. You might notice that eslint-plugin-import does not declare peer dependency on @typescript-eslint/parser, while this is true, it still uses @typescript-eslint/parser in the code without declaring it as some type of dependency and Yarn automatically adds this peer dependency via package extensions:
https://github.com/yarnpkg/berry/blob/master/packages/yarnpkg-extensions/sources/index.ts#L756-L761
The PR to add this peer dependency declaration is here:
import-js/eslint-plugin-import#2283

[larixer]

One way to "fix" this example is to add the following to your .yarnrc.yml:

packageExtensions:
  "eslint-config-next@*":
    peerDependenciesMeta:
      "@typescript-eslint/parser":
        optional: true

[valeriangalliat]

Woah thanks, much appreciated!