Unnecessarily narrow range for React peer deps

[MartinCupela]

Initial checklist

• I read the support docs
• I read the contributing guide
• I agree to follow the code of conduct
• I searched issues and couldn’t find anything (or linked relevant results below)

Affected packages and versions

v9.*

Link to runnable example

No response

Steps to reproduce

1. Have project with React 16.8 / 17
2. Install the latest version of react-markdown with npm 7+

Node: v20
NPM: v10

Expected behavior

Allow to install latest version of react-markdown to projects running on React v16.8 and higher.

At the moment yarn allows to install the react-markdown version 9 and the code runs without issues in projects running on React v16.8 / v17.

Actual behavior

The installation with npm crashes and complains about unmet peer dependency:

npm install react-markdown
npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: test@1.0.0
npm ERR! Found: react@16.14.0
npm ERR! node_modules/react
npm ERR!   react@"16.14" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer react@">=18" from react-markdown@9.0.1
npm ERR! node_modules/react-markdown
npm ERR!   react-markdown@"*" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.

Runtime

No response

Package manager

No response

OS

No response

Build and bundle tools

No response

[wooorm]

It’s intentional: https://github.com/remarkjs/react-markdown/releases/tag/9.0.0. You should update.

[ChristianMurphy]

Adding on.
react-markdown generally aims to support actively maintained platforms and libraries.
Node is has a well documented release and support cycle https://github.com/nodejs/Release#release-schedule and we support active and maintainance LTS releases.
React is a bit fuzzier https://react.dev/community/versioning-policy, from this comment from the maintainer team only latest release has active support reactjs/react.dev#1745 (comment)

Speaking for myself, I have no interest working around bugs that will never be fixed in unsupported releases of React, Node, etc.

---

I'd second @wooorm's recommendation above.
Upgrading to the actively supported React version would be the most secure and best maintained option.

[remcohaszing]

Adding on further, react-markdown uses the JSX automatic runtime, which was broken before React 18.

[MartinCupela]

Thank you for the explanation. In our case we are using this lib in our SDK that is further used by other clients that are reluctant to upgrade their React. So we are in a bit of a pickle here 😄

[ChristianMurphy]

In our case we are using this lib in our SDK that is further used by other clients that are reluctant to upgrade their React.

How you message this to your customers is of course your choice.

• You could continue to use react-markdown version 8, which supports react version 16, with the understanding that neither react version 16 nor react-markdown version 8 are supported
• You could upgrade to react-markdown version 9 and encourage your customers to migrate to react version 18

So we are in a bit of a pickle here

I understand and sympathize.
As an independent open source project, the support matrix is determined at an organization level by the maintainer team based on best practices and bandwidth of maintainers. Not by promises made by the sales team/developer relations team of an enterprise/company unaffiliated with the project.
I hope you understand the frustration that comes when sizeable enterprise focused requests are sent to open source projects, especially from companies that are neither contributing to or supporting the project.

If an organization is interested in supporting maintenance of the project and/or hours for support, there's more info at:

• https://opencollective.com/unified
• https://github.com/sponsors/unifiedjs

---

My obligatory reminder, as even well meaning folks often forget, that in open source, in the terms of every project:

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED

[MartinCupela]

I did not intend to persuade you with my last comment. Your explanation makes total sense and I am thankful you found the time to write it. What I wrote was a small rant 🙂