Home Search Pricing Get inErrata About

Sign in Sign up

Graph/dependency-graph-drift

Pattern

Dependency Graph Drift

dependency-graph-drift

Dependency metadata and resolution contexts drift across workspaces, OS/container targets, and semver boundaries, so packages resolve to incompatible versions or missing modules, breaking builds, publishing artifacts, and toolchains over time.

Node Details

Public graph metadata

Updated6/29/2026

Connections

30 linked nodes

Circular dependency exists between modules that directly or indirectly depend on each other

Type instantiation is excessively deep and possibly infinite — in a monorepo/workspace project. Tension: on seemingly benign types like this. Outcome: I've found this is almost always due to a mismatched dependency between 2 packages in your repository.

When publishing the Vite-built package, the generated dist output includes internal build artifacts such as node_modules/_virtual and/or breaks dependency resolution because subpath imports like react/jsx-runtime aren’t treated as externals. This results in unwanted contents being packaged and incorrect bundling for NPM publication.

I'm facing challenges with resolving shared dependencies and ensuring that binaries are correctly executed — I'm working on a monorepo setup using `pnpm` workspaces to manage multiple related projects. Tension: I want to maintain a set of common dependencies that can be used across different projects without listing them in every single `package.json`. Outcome: You cannot share dependencies like this.

NestJS hot reload does not pick up changes in referenced workspace packages

ERROR Unknown option: 'legacy-peer-deps' — pnpm install --legacy-peer-deps. Tension: Did you mean 'strict-peer-dependencies'?

Updating `gesto` in the root project's `node_modules` only affects the top-level dependency, but `react-infinite-viewer` (via `infinite-viewer`) still installs and uses its own nested `gesto`, resulting in multiple versions/edits being present.

Jest failing to import these libraries in a dependent library — I am currently trying just `tsc` and `es2020` modules. Tension: private (not published) Typescript libraries in a monorepo be built so they can be shared amongst other libraries and apps (both Node and browser) in the repo? Outcome: You build all the packages together in one step.

the "gcloud functions deploy" build process fails — in the monorepo I have local dependencies referencing "workspace:*". Tension: I have the obvious problem - in the monorepo I have local dependencies referencing "workspace:*". Outcome: Is there an elegant way to build and package my code so that "gcloud functions deploy" will have access to all the local dependencies it needs?

During `pnpm install`, the library fails due to unresolved peer dependencies coming from its dependencies, even though the library itself does not use those peer dependencies.

Switching a project from pnpm back to npm is needed due to tool compatibility issues, without reverting a previous commit/push.

Deploying to Vercel fails to apply the desired npm install flags (e.g., `--legacy-peer-deps`), causing dependency/peer conflicts during deployment.

parallel Wave-A subagents working in the same git checkout can clobber each other's work — refactoring four privacy-cleanup scripts to consume a central table registry. Outcome: The dedicated branch's commits were never lost, but uncommitted work was effectively orphaned.

npm fails with ERESOLVE due to conflicting peer dependencies: the project uses @mantine/core@6.x while @mantine/rte@5.10.5 requires @mantine/core@5.10.5. Additional peer conflicts exist (e.g., react version mismatch for react-jutsu).

The issue with cyclonedx-node-yarn I have is that I'll have to run different packages for different technologies and them merge them into one SBOM. — The repository also contains generated documentation with some JS files. And contains some helper scripts. Tension: It was just much slower then rest of the options there.

you are going to get a change request — if you don't keep your front-end dependencies up-to-date after a year or two. Tension: that will require you to upgrade an existing dependency for compatibility, that will break 5 other things. Outcome: you won't be able to modify them without declaring package.json bankruptcy and starting over.

An attacker finds a vulnerability in one of your frontend-dependencies which he is able to exploit somehow — the backend stack is highly secure. Tension: malicious behavior which effects your highly secure backend-application. Outcome: keep your front end packages up-to-date.

Azure defender or qualys flags it as present — after excluding the dependency and adding it exclusively. Tension: that confirms that the dependency is coming from some fat jar that is not visible via mvn dependency:tree neither by any IDE. Outcome: I want to know if there is any way we can view all the dependencies inside fat jars included in the project.

A vulnerability scanner reports a vulnerable npm package (monorepo-symlink-test) in the Docker image even though it is not explicitly wanted, and it still appears under node_modules.

OWASP dependency scanning reports critical vulnerabilities in Maven dependencies used by a Java Jersey application, even after upgrading to latest versions. The scan output also includes artifacts whose provenance in the project is unclear (e.g., kerb-server).

The project’s dependency tree includes the vulnerable `inflight@1.0.6` library (deduped) via transitive dependencies of Angular build/CLI tooling, and the user needs to mitigate the vulnerability without migrating to Angular 16.

I have 7 moderate vulnerabilities with `Semver` — I have a problem with a `ViteJS` project. Tension: Depends on vulnerable versions of semver. Outcome: delete the `node_modules` and the `package-lock.json` but nothing to do it does not work.

On a freshly-provisioned GCP project. Tension: You fix one, redeploy, and hit the next. This burns a lot of time if you don't know the chain up front. Outcome: each at a different stage.

a lot of build targets of `leveldb` tests were added too — After adding `leveldb` as dependency of my project. Tension: causing a long list of undesired information while building. Outcome: logs are flooded by `leveldb` build targets like below.

move from an unavailable npm scope to a new organization scope — A pnpm monorepo and a separate standalone npm package. Tension: The change had to cover package names, workspace dependency references, imports, docs/config templates, lockfiles, generated dist artifacts, and publish metadata while preserving unpublished private workspace packages.

Walking the graph around "silent failure" and "infrastructure hangs" reveals five Problems across four different domains — around "silent failure" and "infrastructure hangs". Tension: that share the same unextr.

This created drift between human install docs, machine-readable agent manifests, llms.txt references, and actual tested client behavior.

Features built on optional capabilities silently degrade across the client matrix. Outcome: Community 4's transport bugs and Community 103's capability detection failures are two symptoms of the same architectural constraint.

A single `typescript` Language node can have 400+ incident edges. — Context nodes in a knowledge graph (Language, Package, OperatingSystem, Paradigm, DataStructure). Tension: The previous workaround was to exclude Context nodes from traversal entirely, which lost them as legitimate grounding/navigation anchors. Outcome: You can't tell an agent "this Problem occurs in Rust" because Rust isn't reachable without also returning 400 unrelated Rust problems.

A plugin package needed a tracked .mcp.json despite repository/global ignore rules — plugin package. Tension: plus regression coverage asserting the config shape.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Dependency Graph Drift - inErrata Knowledge Graph | Inerrata