运行npm install遇依赖冲突错误，由Snyk生成的PR引发

问题背景 #

运行npm install时触发ERESOLVE依赖冲突，根源是Snyk创建的PR将@angular-devkit/build-angular升级到了18.2.11，但项目中@angular/compiler-cli仍停留在13.3.12版本，两者的peer依赖要求不匹配：

• @angular-devkit/build-angular@18.2.11要求peer依赖@angular/compiler-cli@^18.0.0
• 当前项目依赖@angular/compiler-cli@~13.3.0

错误日志如下：

npm error code ERESOLVE

npm error ERESOLVE could not resolve
npm error
npm error While resolving: @angular-devkit/build-angular@18.2.11
npm error Found: @angular/compiler-cli@13.3.12
npm error node_modules/@angular/compiler-cli
npm error   dev @angular/compiler-cli@"~13.3.0" from the root project
npm error
npm error Could not resolve dependency:
npm error peer @angular/compiler-cli@"^18.0.0" from @angular-devkit/build-angular@18.2.11
npm error node_modules/@angular-devkit/build-angular
npm error   dev @angular-devkit/build-angular@"^18.2.11" from the root project
npm error
npm error Conflicting peer dependency: @angular/compiler-cli@18.2.11
npm error node_modules/@angular/compiler-cli
npm error   peer @angular/compiler-cli@"^18.0.0" from @angular-devkit/build-angular@18.2.11
npm error   node_modules/@angular-devkit/build-angular
npm error     dev @angular-devkit/build-angular@"^18.2.11" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /home/runner/.npm/_logs/2024-11-12T23_36_23_968Z-eresolve-report.txt
npm notice
npm notice New minor version of npm available! 10.8.1 -> 10.9.0
npm notice Changelog: https://github.com/npm/cli/releases/tag/v10.9.0
npm notice To update run: npm install -g npm@10.9.0
npm notice
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2024-11-12T23_36_23_968Z-debug-0.log

解决方案 #

方案1：回退不兼容的Snyk PR #

由于Snyk的PR直接跨大版本升级Angular构建工具，导致与现有Angular版本不兼容，最简单的解决方式是回退相关PR，保持依赖版本匹配：

• 回退Snyk创建的PR（编号18-22），恢复@angular-devkit/build-angular到与@angular/compiler-cli@13.x兼容的版本（通常是~13.3.x）
• 回退后运行npm install验证问题是否解决

方案2：全量升级Angular版本（推荐长期解决） #

如果计划升级Angular版本，需同步升级所有核心Angular依赖到18.x，确保版本一致：

1. 使用Angular官方升级工具升级：

   ng update @angular/cli@18 @angular/core@18
   

2. 升级完成后，检查package.json中所有@angular/*依赖版本是否统一为18.x
3. 运行npm install确认依赖冲突解决

方案3：临时绕过冲突（不推荐生产环境） #

如果需要临时安装依赖，可使用npm的强制参数绕过peer依赖检查，但可能导致运行时问题：

npm install --legacy-peer-deps

或

npm install --force

关键说明 #

Angular的构建工具@angular-devkit/build-angular必须与Angular核心依赖（包括@angular/compiler-cli）保持大版本一致，跨大版本升级会触发peer依赖冲突，这是Angular版本管控的核心规则。

内容的提问来源于stack exchange，提问作者oc-2