@deepseek-ai/dsh: internal peer dependency conflict between cordis-plugin-hmr and dsh-acp-app

[baoyu0]

Bug: Internal Peer Dependency Conflict in @deepseek-ai/dsh

Description

Installing @deepseek-ai/dsh@latest produces hundreds of npm warn ERESOLVE overriding peer dependency warnings due to an internal version mismatch between sub-packages within the same monorepo.

Conflicting Dependencies

Package	Required @deepseek-ai/cordis
@deepseek-ai/cordis-plugin-hmr@1.0.19	~4.0.4
@deepseek-ai/dsh-acp-app@0.1.5-rc.3	4.0.2

Reproduction

npm install -g @deepseek-ai/dsh@latest

Produces hundreds of warnings like:

npm warn ERESOLVE overriding peer dependency
npm warn Conflicting peer dependency: @deepseek-ai/cordis@4.0.2
npm warn   peer @deepseek-ai/cordis@"~4.0.4" from @deepseek-ai/cordis-plugin-hmr@1.0.19

Environment

• OS: Windows 11
• npm: 12.0.2
• Node.js: via miniconda

Impact

• Noisy install output with hundreds of warnings
• May confuse users into thinking the install failed or is broken
• Indicates an internal inconsistency in the monorepo's dependency declarations

Suggested Fix

Align @deepseek-ai/cordis version requirements across all @deepseek-ai/dsh-* sub-packages so they reference a single compatible version.

[PerryLink]

The two conflicting declarations are real - I read them from the registry - and one of them is the kind of pin that makes this class of warning inevitable.

@deepseek-ai/cordis-plugin-hmr@1.0.19      peerDependencies: { "@deepseek-ai/cordis": "~4.0.4" }
@deepseek-ai/dsh-acp-app@0.1.5-rc.3        peerDependencies: { "@deepseek-ai/cordis": "4.0.2" }

Note the asymmetry: one is a tilde range, the other an exact pin. Two packages in the same release set disagreeing that way is enough for npm to emit ERESOLVE overriding peer dependency for every edge that touches either of them, which is why you see hundreds of lines rather than one.

One thing I could not confirm, and it is the part worth checking. In the published 0.1.5-rc.3 set, @deepseek-ai/cordis-plugin-hmr is pinned exactly 1.0.17 by both packages that declare it:

@deepseek-ai/dsh@0.1.5-rc.3        "@deepseek-ai/cordis-plugin-hmr": "1.0.17"   "@deepseek-ai/cordis": "4.0.2"
@deepseek-ai/dsh-base@0.1.5-rc.3   "@deepseek-ai/cordis-plugin-hmr": "1.0.17"
@deepseek-ai/dsh-web-app@0.1.5-rc.3  (does not depend on it)

So nothing in the closure I queried should install 1.0.19, yet your log shows it. Either your install resolved a different top-level version (the latest tag moved from 0.1.5-rc.2 to 0.1.5-rc.3 very recently), or a package outside that closure pulls it.

Please add one command's output to the thread: npm ls @deepseek-ai/cordis-plugin-hmr --all (or the first ~30 lines of the install log with the Conflicting peer dependency block). That names the parent, and without it the fix has two different shapes:

• if something declares ^1.0.17, the fix is to align that range with the set's exact pin (or align the set upward to a cordis that satisfies ~4.0.4);
• if nothing does, the warning came from a stale lockfile or a cached resolution, and reinstalling cleanly is the whole answer.

Two things I can say regardless of that: the warnings are not install failures (ERESOLVE overriding means npm proceeded), and your suggested fix is the right general direction - but the specific change matters, because bumping @deepseek-ai/cordis for one package without the others is what produced this state in the first place.

Boundary: every range above was read live from registry.npmjs.org today. I did not run the install, and I did not determine which package brings 1.0.19.