Next.js v10.0.0 forces React v17 to be installed

[jaydenseric]

Bug report

Describe the bug

next v10.0.0 forces react v17 to be installed, even if the project has react v16 in dependencies.

This is because next v10.0.0 has a use-subscription v1.5.0 dependency pinned:

next.js/packages/next/package.json

Line 117 in 118ab79

"use-subscription": "1.5.0",

use-subscription v1.5.0 has a react peer dependency of ^17.0.0 (v16 not supported):

https://unpkg.com/use-subscription@1.5.0/package.json

With a project that has a react v16 dependency, npm v6 at install time would emit a warning that the use-subscription peer dependency on react is not satisfied, but it would not install react v17. While this may seem ok, it probably is not because use-subscription declared react v16 is not supported, so who knows if it will have problems in it's function.

With npm v7, which automatically installs peer dependencies as needed, this results in react v16 being installed to fulfill the project dependency, and react v17 to fulfill the use-subscription peer dependency. The result is that multiple versions of react get installed, and this can cause a React render error that multiple instances of React are being used with hooks.

To Reproduce

1. In a hello-world Next.js project, ensure React v16 is specified in the package dependencies.
2. Use npm v7 to install the project.
3. Run npm ls react to see the multiple versions installed. This in itself is bad.
4. At this point, you could try to run npm run dev to see if you get the same React render error I do in my project about hooks and multiple React instances, but I'm not 100% sure if it will happen out of the box or if you need to use some particular hooks to see the issue.

Expected behavior

When used with npm v6 or v7, next should respect the version of react installed in the user's project, and not cause multiple versions of react to be installed.

Screenshots

System information

• OS: macOS 10.15.7
• Version of Next.js: 10.0.0
• Version of Node.js: Any compatible with npm v6, v7
• Version of npm: v7 especially

[adammockor]

I have exactly the same problem with same setup.

[sungsong88]

I have the same issue here

[billyjanitsch]

A bit of additional context: React made a breaking change between use-subscription@1.4.1 and use-subscription@1.5.0 (updating the React peer dependency from ^16.8.0 to ^17.0.0). Next.js upgraded this dependency in #18199, noting that it would cause a peer deps issue for React 16 users, but ideally it wouldn't cause issues for either major version of React.

I reported the upstream issue here: facebook/react#20224. Hopefully it gets fixed by way of releasing a version of use-subscription that peer-depends on ^16.8.0 || ^17.0.0 such that Next.js can upgrade to it and retain support for both major versions of React.

cc @timneutkens who authored the dependency upgrade PR.

[gaearon]

React made a breaking change

While I understand the frustration, I don't think there is a common consensus that changing a peer dependency in any way constitutes a breaking change by itself. (In part because they have been not considered in the algorithm for a very long time.)

It is news to me that npm v7 has changed the behavior to consider peer dependencies in the algorithm. This is actually pretty worrying for our use case because react must be a singleton (it's used for dependency injection), and we would rather refuse the installation than have two copies in the tree.

I think this npm design might force our hand to simply remove the peerDependencies and let the user figure out the matching versions themselves. Because the auto-installing seems much worse.

[gaearon]

Where can I read about the auto-installing and whether this decision in npm is final?