Angular 19.1升级至19.2时rxjs npm依赖冲突问题排查与疑问

我最近在把项目的Angular版本从19.1升级到19.2时，碰到了一个完全摸不着头脑的npm依赖冲突问题。翻了好几个小时相关的依赖问题资料，但还是搞不懂大部分报错的逻辑——有时候明明版本完全符合约束，却还是弹出冲突提示。

先给大家看一下我遇到的具体错误信息：

While resolving: myproject.front@0.0.0
Found: rxjs@7.8.2
node_modules/rxjs
  rxjs@"7.8.2" from the root project
  rxjs@">=7.5.0" from @fronts/ui-dynamic-components@24.295.2
  node_modules/@fronts/ui-dynamic-components
    @fronts/ui-dynamic-components@"^24.295.2" from the root project
peer rxjs@"^6.5.3 || ^7.4.0" from @angular/common@19.2.14
node_modules/@angular/common
  @angular/common@"19.2.14" from the root project
  peer overridden @angular/common@"19.2.14" (was "^17.0.0 || ^16.0.0") from @fronts/ui-dynamic-components@24.295.2
  node_modules/@fronts/ui-dynamic-components
    @fronts/ui-dynamic-components@"^24.295.2" from the root project

Could not resolve dependency:
peer rxjs@"^6.5.3 || ^7.4.0" from @angular/core@19.2.14
node_modules/@angular/core
  @angular/core@"19.2.14" from the root project
  peer overridden @angular/core@"19.2.14" (was "^17.0.0 || ^16.0.0") from @fronts/ui-dynamic-components@24.295.2
  node_modules/@fronts/ui-dynamic-components
    @fronts/ui-dynamic-components@"^24.295.2" from the root project
peer @angular/core@"19.2.14" from @angular/common@19.2.14
node_modules/@angular/common
  @angular/common@"19.2.14" from the root project
  peer overridden @angular/common@"19.2.14" (was "^17.0.0 || ^16.0.0") from @fronts/ui-dynamic-components@24.295.2
  node_modules/@fronts/ui-dynamic-components
    @fronts/ui-dynamic-components@"^24.295.2" from the root project

Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.

补充一下背景：@fronts/ui-dynamic-components是我们内部维护的库，没办法修改它的依赖配置——它原本指定的兼容Angular版本是16和17，但我们项目里通过overrides强制让它适配当前项目的Angular 19版本，配置如下：

"overrides": {
  "@fronts/ui-dynamic-components": {
    "@angular/common": "$@angular/common",
    "@angular/core": "$@angular/core",
    "@angular/forms": "$@angular/forms",
    "@angular/platform-browser": "$@angular/platform-browser",
    "@angular-devkit/build-angular": "$@angular-devkit/build-angular"
  }
}

我自己梳理了一遍依赖约束：

• @fronts/ui-dynamic-components@24.295.2要求rxjs版本>=7.5.0
• @angular/core@19.2.14要求rxjs版本^6.5.3 || ^7.4.0
• 我们项目根目录指定的rxjs版本是7.8.2

按道理说，7.8.2完全满足这两个约束啊！我甚至特意仔细校验过语义化版本的兼容性，确认没问题，但npm就是固执地报冲突，这让我百思不得其解。

我不太想用--force或者--legacy-peer-deps来强行跳过这个错误，毕竟如果没搞懂问题根源就忽略提示，总担心后续会埋下隐藏的bug。所以想请教大家：

• 这个冲突到底是怎么回事？明明版本符合要求，为什么npm还报错？
• 什么时候使用--legacy-peer-deps才算是“安全”的？

我当前使用的环境是Node v22.19.0和NPM v11.4.2。

内容来源于stack exchange