Compartment Mapper should gracefully include peerDependencies only if present

[kriskowal]

Describe the bug

The Compartment Mapper reaches for peerDependencies during mapNodeModules, and if the package manager did not arrange for them, the routine fails with an exception for a missing transitive package. We should instead include each peer dependency in the packages map only if it’s physically present.

Steps to reproduce

Contrive a package graph that contains peerDependencies that are alternately present or absent and observe that the compartment mapper can link the peerDependencies only if they are present, regardless of whether they’re imported by the entry module.

Expected behavior

mapNodeModules should tolerate the absence of a peer dependency, allowing a module graph to link as long as it doesn’t attempt to import the peer dependency.

Platform environment

All at time of writing (2024-11-18)

[kriskowal]

Reviewing our code for this case, it seems that peerDependencies are not in fact optional, unless specified as optional in optionalDependencies or peerDependenciesMeta with optional: true. So, the implementation is consistent and provides a useful diagnostic for invalid node_modules trees. We could instead ignore peerDependenciesMeta and treat all peerDependencies or even all dependencies as optional if there is no corresponding physical package, which would defer linkage errors to load. Those errors might be less informative.