github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-10-18 11:32:15 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #9083] vitest and its dependencies are installed with npm ci --omit=dev #19899

New Issue
Open
opened 2026-04-15 19:15:41 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-04-15 19:15:41 -05:00
Owner
Copy Link
Copy Source

Originally created by @n-e on GitHub (Apr 9, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/9083

Is this suited for github?

  • Yes, this is suited for github

Reproduction

In an empty directory run:

npm init -y
npm i -D vitest
npm i better-auth
npm ci --omit=dev
npm explain vitest

Current vs. Expected behavior

When better-auth is installed, vitest, despite being a dev dependency is installed when running npm ci --omit=dev.

I don't expect this, as vitest and its dependencies are heavy.

This happens because better-auth declares vitest as an optional peer dependency. npm installs dependencies that are both a direct dev dependency and an optional peer dependency even with --omit=dev.

What version of Better Auth are you using?

1.6.2

System info

{
  "system": {
    "platform": "darwin",
    "arch": "arm64",
    "version": "Darwin Kernel Version 25.3.0: Wed Jan 28 20:56:34 PST 2026; root:xnu-12377.91.3~2/RELEASE_ARM64_T8112",
    "release": "25.3.0",
    "cpuCount": 8,
    "cpuModel": "Apple M2",
    "totalMemory": "16.00 GB",
    "freeMemory": "0.24 GB"
  },
  "node": {
    "version": "v24.14.0",
    "env": "development"
  },
  "packageManager": {
    "name": "npm",
    "version": "11.9.0"
  },
  "frameworks": null,
  "databases": null,
  "betterAuth": {
    "version": "^1.6.2",
    "config": null
  }
}

Which area(s) are affected? (Select all that apply)

Package

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true
  },
});

Additional context

No response

Originally created by @n-e on GitHub (Apr 9, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/9083 ### Is this suited for github? - [x] Yes, this is suited for github ### Reproduction In an empty directory run: ``` npm init -y npm i -D vitest npm i better-auth npm ci --omit=dev npm explain vitest ``` ### Current vs. Expected behavior When better-auth is installed, vitest, despite being a dev dependency is installed when running `npm ci --omit=dev`. I don't expect this, as vitest and its dependencies are heavy. This happens because better-auth declares vitest as an optional peer dependency. npm installs dependencies that are both a direct dev dependency and an optional peer dependency even with --omit=dev. ### What version of Better Auth are you using? 1.6.2 ### System info ```bash { "system": { "platform": "darwin", "arch": "arm64", "version": "Darwin Kernel Version 25.3.0: Wed Jan 28 20:56:34 PST 2026; root:xnu-12377.91.3~2/RELEASE_ARM64_T8112", "release": "25.3.0", "cpuCount": 8, "cpuModel": "Apple M2", "totalMemory": "16.00 GB", "freeMemory": "0.24 GB" }, "node": { "version": "v24.14.0", "env": "development" }, "packageManager": { "name": "npm", "version": "11.9.0" }, "frameworks": null, "databases": null, "betterAuth": { "version": "^1.6.2", "config": null } } ``` ### Which area(s) are affected? (Select all that apply) Package ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ emailAndPassword: { enabled: true }, }); ``` ### Additional context _No response_
GiteaMirror commented 2026-04-15 19:15:43 -05:00
Author
Owner
Copy Link
Copy Source

@MuzzaiyyanHussain commented on GitHub (Apr 10, 2026):

Hi @n-e , This is expected npm behavior.
--omit=dev skips devDependencies, but peer dependencies can still cause them to be installed/retained if they satisfy another package (like better-auth here).

So it’s not exactly a bug, but I agree it’s unintuitive.

<!-- gh-comment-id:4221798178 --> @MuzzaiyyanHussain commented on GitHub (Apr 10, 2026): Hi @n-e , This is expected npm behavior. `--omit=dev` skips devDependencies, but peer dependencies can still cause them to be installed/retained if they satisfy another package (like `better-auth` here). So it’s not exactly a bug, but I agree it’s unintuitive.
GiteaMirror commented 2026-04-15 19:15:45 -05:00
Author
Owner
Copy Link
Copy Source

@n-e commented on GitHub (Apr 10, 2026):

So it’s not exactly a bug, but I agree it’s unintuitive.

I agree, however the problem is that projects that depend on vitest for testing and better-auth have vitest installed with --omit=dev, resulting in a 30MB larger package.

Also I'm not sure why vitest is an optional peer dependency of better-auth, not just a devDependency.

<!-- gh-comment-id:4222165345 --> @n-e commented on GitHub (Apr 10, 2026): > So it’s not exactly a bug, but I agree it’s unintuitive. I agree, however the problem is that projects that depend on vitest for testing and better-auth have vitest installed with --omit=dev, resulting in a 30MB larger package. Also I'm not sure why vitest is an optional peer dependency of better-auth, not just a devDependency.
GiteaMirror commented 2026-04-15 19:15:46 -05:00
Author
Owner
Copy Link
Copy Source

@MuzzaiyyanHussain commented on GitHub (Apr 10, 2026):

Agree on the production size issue, that’s a valid concern.

Feels like vitest shouldn’t be a peer dependency in the first place. If it’s only used internally, it should be a devDependency. But if exported utilities depend on it, removing it without restructuring could break consumers.

Maybe better to isolate test utilities or remove any runtime reliance on vitest.

<!-- gh-comment-id:4222304135 --> @MuzzaiyyanHussain commented on GitHub (Apr 10, 2026): Agree on the production size issue, that’s a valid concern. Feels like `vitest` shouldn’t be a peer dependency in the first place. If it’s only used internally, it should be a devDependency. But if exported utilities depend on it, removing it without restructuring could break consumers. Maybe better to isolate test utilities or remove any runtime reliance on `vitest`.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#19899