bug: optional peer dependencies are installed without being present in any `dependencies` or `devDependencies` fields

[juliusmarminge]

Provide environment information

Need to install the following packages:
envinfo@7.14.0
Ok to proceed? (y) 


  System:
    OS: macOS 15.6.1
    CPU: (8) arm64 Apple M1 Pro
    Memory: 122.39 MB / 16.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 22.19.0 - ~/.local/state/fnm_multishells/75077_1757281931230/bin/node
    npm: 10.9.3 - ~/.local/state/fnm_multishells/75077_1757281931230/bin/npm
    pnpm: 10.15.1 - ~/.local/state/fnm_multishells/75077_1757281931230/bin/pnpm
    bun: 1.2.21 - ~/.bun/bin/bun

Describe the bug

pnpm install installs a bunch of shit that isn't needed...

Link to reproduction

https://github.com/t3-oss/create-t3-turbo

To reproduce

Run something like pnpm why -r arktype or pnpm why -r prisma and you'll see those packages are installed despite no references to them anywhere in the repo apart from the lockfile:

`pnpm why -r prisma`

Legend: production dependency, optional only, dev only

@acme/expo@0.1.0 /Users/julius/dev/create-t3-turbo/apps/expo (PRIVATE)

devDependencies:
@acme/api link:../../packages/api
├─┬ @acme/auth link:../../packages/auth
│ └─┬ @acme/db link:../../packages/db
│   ├─┬ drizzle-orm 0.44.5
│   │ ├─┬ @prisma/client 5.22.0 peer
│   │ │ └── prisma 5.22.0 peer
│   │ └── prisma 5.22.0 peer
│   └─┬ drizzle-zod 0.8.3
│     └─┬ drizzle-orm 0.44.5 peer
│       ├─┬ @prisma/client 5.22.0 peer
│       │ └── prisma 5.22.0 peer
│       └── prisma 5.22.0 peer
└─┬ @acme/db link:../../packages/db
  ├─┬ drizzle-orm 0.44.5
  │ ├─┬ @prisma/client 5.22.0 peer
  │ │ └── prisma 5.22.0 peer
  │ └── prisma 5.22.0 peer
  └─┬ drizzle-zod 0.8.3
    └─┬ drizzle-orm 0.44.5 peer
      ├─┬ @prisma/client 5.22.0 peer
      │ └── prisma 5.22.0 peer
      └── prisma 5.22.0 peer

@acme/nextjs@0.1.0 /Users/julius/dev/create-t3-turbo/apps/nextjs (PRIVATE)

dependencies:
@acme/api link:../../packages/api
├─┬ @acme/auth link:../../packages/auth
│ └─┬ @acme/db link:../../packages/db
│   ├─┬ drizzle-orm 0.44.5
│   │ ├─┬ @prisma/client 5.22.0 peer
│   │ │ └── prisma 5.22.0 peer
│   │ └── prisma 5.22.0 peer
│   └─┬ drizzle-zod 0.8.3
│     └─┬ drizzle-orm 0.44.5 peer
│       ├─┬ @prisma/client 5.22.0 peer
│       │ └── prisma 5.22.0 peer
│       └── prisma 5.22.0 peer
└─┬ @acme/db link:../../packages/db
  ├─┬ drizzle-orm 0.44.5
  │ ├─┬ @prisma/client 5.22.0 peer
  │ │ └── prisma 5.22.0 peer
  │ └── prisma 5.22.0 peer
  └─┬ drizzle-zod 0.8.3
    └─┬ drizzle-orm 0.44.5 peer
      ├─┬ @prisma/client 5.22.0 peer
      │ └── prisma 5.22.0 peer
      └── prisma 5.22.0 peer
@acme/auth link:../../packages/auth
└─┬ @acme/db link:../../packages/db
  └─┬ drizzle-orm 0.44.5
    ├─┬ @prisma/client 5.22.0 peer
    │ └── prisma 5.22.0 peer
    └── prisma 5.22.0 peer

@acme/api@0.1.0 /Users/julius/dev/create-t3-turbo/packages/api (PRIVATE)

dependencies:
@acme/auth link:../auth
└─┬ @acme/db link:../db
  ├─┬ drizzle-orm 0.44.5
  │ ├─┬ @prisma/client 5.22.0 peer
  │ │ └── prisma 5.22.0 peer
  │ └── prisma 5.22.0 peer
  └─┬ drizzle-zod 0.8.3
    └─┬ drizzle-orm 0.44.5 peer
      ├─┬ @prisma/client 5.22.0 peer
      │ └── prisma 5.22.0 peer
      └── prisma 5.22.0 peer
@acme/db link:../db
├─┬ drizzle-orm 0.44.5
│ ├─┬ @prisma/client 5.22.0 peer
│ │ └── prisma 5.22.0 peer
│ └── prisma 5.22.0 peer
└─┬ drizzle-zod 0.8.3
  └─┬ drizzle-orm 0.44.5 peer
    ├─┬ @prisma/client 5.22.0 peer
    │ └── prisma 5.22.0 peer
    └── prisma 5.22.0 peer

@acme/auth@0.1.0 /Users/julius/dev/create-t3-turbo/packages/auth (PRIVATE)

dependencies:
@acme/db link:../db
├─┬ drizzle-orm 0.44.5
│ ├─┬ @prisma/client 5.22.0 peer
│ │ └── prisma 5.22.0 peer
│ └── prisma 5.22.0 peer
└─┬ drizzle-zod 0.8.3
  └─┬ drizzle-orm 0.44.5 peer
    ├─┬ @prisma/client 5.22.0 peer
    │ └── prisma 5.22.0 peer
    └── prisma 5.22.0 peer

devDependencies:
@better-auth/cli 1.3.8
├─┬ @prisma/client 5.22.0
│ └── prisma 5.22.0 peer
├─┬ drizzle-orm 0.33.0
│ ├─┬ @prisma/client 5.22.0 peer
│ │ └── prisma 5.22.0 peer
│ └── prisma 5.22.0 peer
└── prisma 5.22.0

@acme/db@0.1.0 /Users/julius/dev/create-t3-turbo/packages/db (PRIVATE)

dependencies:
drizzle-orm 0.44.5
├─┬ @prisma/client 5.22.0 peer
│ └── prisma 5.22.0 peer
└── prisma 5.22.0 peer
drizzle-zod 0.8.3
└─┬ drizzle-orm 0.44.5 peer
  ├─┬ @prisma/client 5.22.0 peer
  │ └── prisma 5.22.0 peer
  └── prisma 5.22.0 peer

`pnpm why -r arktype`

Legend: production dependency, optional only, dev only

@acme/expo@0.1.0 /Users/julius/dev/create-t3-turbo/apps/expo (PRIVATE)

devDependencies:
@acme/api link:../../packages/api
└─┬ @acme/auth link:../../packages/auth
  └─┬ @t3-oss/env-nextjs 0.13.8
    ├─┬ @t3-oss/env-core 0.13.8
    │ └── arktype 2.1.20 peer
    └── arktype 2.1.20 peer

@acme/nextjs@0.1.0 /Users/julius/dev/create-t3-turbo/apps/nextjs (PRIVATE)

dependencies:
@acme/api link:../../packages/api
└─┬ @acme/auth link:../../packages/auth
  └─┬ @t3-oss/env-nextjs 0.13.8
    ├─┬ @t3-oss/env-core 0.13.8
    │ └── arktype 2.1.20 peer
    └── arktype 2.1.20 peer
@acme/auth link:../../packages/auth
└─┬ @t3-oss/env-nextjs 0.13.8
  ├─┬ @t3-oss/env-core 0.13.8
  │ └── arktype 2.1.20 peer
  └── arktype 2.1.20 peer
@t3-oss/env-nextjs 0.13.8
├─┬ @t3-oss/env-core 0.13.8
│ └── arktype 2.1.20 peer
└── arktype 2.1.20 peer

@acme/api@0.1.0 /Users/julius/dev/create-t3-turbo/packages/api (PRIVATE)

dependencies:
@acme/auth link:../auth
└─┬ @t3-oss/env-nextjs 0.13.8
  ├─┬ @t3-oss/env-core 0.13.8
  │ └── arktype 2.1.20 peer
  └── arktype 2.1.20 peer

@acme/auth@0.1.0 /Users/julius/dev/create-t3-turbo/packages/auth (PRIVATE)

dependencies:
@t3-oss/env-nextjs 0.13.8
├─┬ @t3-oss/env-core 0.13.8
│ └── arktype 2.1.20 peer
└── arktype 2.1.20 peer

A deeper look at all packages that declares this peer dep they all have them marked as optional...

Additional information

No response

[juliusmarminge]

Related: pnpm/pnpm#5928 (pnpm/pnpm#5928 (comment))