Don't know how this weird thing happened since I can see the updated package.json in Github does not have "mongoose" in the "dependencies" section.
But when doing "npm view graphql-compose-mongoose" it is clear that the package.json in the registry still has this dependencies section:
dependencies:
{ 'babel-runtime': '^6.20.0',
'graphql-compose': '^1.7.0',
'graphql-compose-connection': '^2.1.2',
mongoose: '^4.7.4',
'object-path': '^0.11.3' },
Not sure how critical this is but it caused some trouble for me - same is with graphql-compose which has graphql in it's dependencies section.
Probably has to do with how the package was updated in npm once those dependencies were converted to peer dependencies.