Yarn ignores bundledDependencies and copies all node_modules for file: packages

[flarnie]

Do you want to request a feature or report a bug?
This is a bug.

What is the current behavior?
In an example app from the Draft.js project, if I run yarn install I end up with both node_modules/react and node_modules/draft-js/node_modules/react. The second is a duplicate, and causes the "Refs must have an owner" warning

To compare - if I rm -rf node_modules && npm install in that same directory, I do not end up with node_modules/draft-js/node_modules/react.

If the current behavior is a bug, please provide the steps to reproduce.
If you clone the Draft.js github repo, yarn install && yarn build, and then follow the README in the universal example you should see the warning in the console and the node_modules situation I described above.

What is the expected behavior?

Draft.js lists react as a peerDependency, so I don't expect it to be installed when there is a sibling react module in node_modules.

Please mention your node.js, yarn and operating system version.
I just updated Yarn to 1.0.2 and used n to run node v4.8.4.

[gaearon]

Can you reproduce with Yarn 1.1.0?

[BYK]

Most peerDependency issues should be resolved by #4478. That said I tried to replicate this locally and was able to reproduce it consistently because react is also listed as a devDependency under darft-js. Although ideally they'd be deduplicated, there's no guarantee that a dev dependency of darft-js will also be satisfied by its peer dependency. Also, they have different ranges too. I tried removing react and react-dom from devDependencies of draft-js and the duplication went away.

Do you think we can fix this somehow by not listing react in both places? Maybe something like #1503?

[gaearon]

That said I tried to replicate this locally and was able to reproduce it consistently because react is also listed as a devDependency under darft-js.

Why does this matter though? devDependencies should only be installed when you run install inside of the package that specifies them. In my understanding, running install inside an example that depends on draft-js should not install devDependencies of draft-js.

[BYK]

I think this is due to the file: protocol but I need to investigate more.

[BYK]

So this is happening because when you use file: yarn simply copies the whole contents of that folder, including node_modules which comes with its own react dependency. Ideally, it would "pack" the folder on the fly and use it which means omitting node_modules unless there are bundled dependencies. I don't know how npm does it correctly since with npm 5, they actually changed the meaning of file: to be link: where it is impossible to avoid this.

[BYK]

Turns out this is a duplicate of #3344 so closing in favor of that.