[rdself]

Summary

• Set NPM_CONFIG_LEGACY_PEER_DEPS=true inside the Docker builder before npm ci runs.
• Remove the duplicate postinstallSupport.mjs copy in the dependency install layer.

Impact

• The Docker install issue prevented the v3.7.0 container image from being built correctly.

Root Cause

The release lockfile relies on npm legacy peer dependency resolution to avoid installing unused @lobehub/icons peer packages. The Docker build did not provide that npm config before npm ci, so npm attempted to resolve the peer dependency tree and failed with lockfile sync errors for @lobehub/ui, antd, lucide-react, and related packages.

Validation

• git diff --check
• Reproduced the install failure in a clean temp directory without legacy peer dependency config.
• Confirmed NPM_CONFIG_LEGACY_PEER_DEPS=true npm ci --ignore-scripts --dry-run --no-audit --no-fund succeeds in a clean temp directory without copying .npmrc.
• Commit hook checks passed: docs sync and explicit-any budget.

Docker daemon was not available locally, so the full image build is left to CI.

[gemini-code-assist]

Code Review

This pull request modifies the Dockerfile to include the .npmrc file and cleans up a duplicate COPY instruction. The review feedback highlights security and portability concerns regarding the inclusion of .npmrc and recommends using an environment variable for npm configuration instead.

[gemini-code-assist]

Copying .npmrc into the Docker image is generally discouraged for two reasons:

1. Security: If the file contains sensitive information (such as authentication tokens for private registries), it will be baked into the image layers, creating a security risk even if the file is not present in the final stage.
2. Portability: If .npmrc is not checked into the repository (which is common for local or environment-specific configurations), the docker build command will fail for other developers or in CI environments with a "file not found" error.

Since the stated goal is to enable legacy-peer-deps=true, it is safer and more robust to use an environment variable. This achieves the same result without requiring an external file and ensures the build is self-contained.

ENV NPM_CONFIG_LEGACY_PEER_DEPS=true

[Copilot]

Pull request overview

Fixes Docker image builds by ensuring npm’s install-time configuration is present in the cached dependency-install layer.

Changes:

• Copy .npmrc into the builder stage before running npm ci / npm install, so installs respect legacy-peer-deps=true.
• Remove a duplicate COPY of scripts/postinstallSupport.mjs in the same layer.

[diegosouzapw]

Thanks @rdself for catching this Docker build issue! The fix has been squash-merged into release/v3.7.1 and will ship in the next release. Great catch on the duplicate COPY line too. We appreciate the contribution! 🎉