Conflicting semantic-release and semantic-release/npm dependencies

[jusa3]

I get a dependecy conflict with semantic-release when installing the latest release of this package:

npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: @ts4nfdi/terminology-service-suite@3.1.0
npm ERR! Found: semantic-release@24.2.1
npm ERR! node_modules/semantic-release
npm ERR!   dev semantic-release@"^24.2.0" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer semantic-release@"^19.x" from @amanda-mitchell/semantic-release-npm-multiple@3.11.1
npm ERR! node_modules/@amanda-mitchell/semantic-release-npm-multiple
npm ERR!   dev @amanda-mitchell/semantic-release-npm-multiple@"^3.11.1" from the root project

Furthermore, the semantic-release/npm v12.0.1 seems to also need a higher semantic-release version than defined in your peer deps.
In your package.json, you have two versions of semantic-release. How is this to be understood?

"devDependencies": {
    "@commitlint/config-conventional": "^19.0.0",
    "commitlint": "^19.0.0",
    "husky": "4.x",
    "jest": "^29.7.0",
    "lint-staged": "^15.0.1",
    "prettier": "^3.0.2",
    "semantic-release": "^24.2.0"
  },
  "dependencies": {
    "@semantic-release/npm": "^12.0.1"
  },
  "peerDependencies": {
    "semantic-release": "^19.x"
  }

[BinToss]

The semantic-release dev dependency is only used for releasing this project. The peer dependency is what this plugin is compatible with. Forcing the peer dependency to a different version will lead to undefined behavior. Or errors where a breaking change was made in semantic-release 20 or later.

As for the difference in the peer dependency version and the version required by @semantic-release/npm? It was probably an oversight when merging Dependabot dependency update PRs.

This version range may be required due to issues mentioned in semantic-release/semantic-release#3038

This project dogfoods i.e. it uses Semantic Release 24 and itself to publish itself to both npmjs.com and GitHub Package Registry. The peer dependency semver range seems to be ignored when dogfooding. @semantic-release/npm and other first-party plugins have semantic-release as a peer-dep, too, but with >= (at least version) instead of ^ (at least version, but within current Major version)

See https://github.com/semantic-release/npm/blob/01f1cd04dd0f827a4b62fbaad93dbed3bed6fea9/package.json#L90-L92