yarnpkg/yarn

`yarn upgrade` breaks dependencies

Open

#3,202 opened on Apr 20, 2017

View on GitHub
 (17 comments) (24 reactions) (0 assignees)JavaScript (41,514 stars) (2,731 forks)batch import
cat-bughelp wantedtriaged

Description

Do you want to request a feature or report a bug?

Bug.

What is the current behavior?

yarn upgrade updates the version of npmlog, but does not check its dependencies.

If the current behavior is a bug, please provide the steps to reproduce.

Suppose you have a very simple package.json file like following:

{
  "dependencies": {
    "npm": "^3.10.5"
  }
}

Run yarn. You will find the folder structure is like:

node_modules
├─npm@3.10.10
│  ├─npmlog@4.0.0
│  │  ├─gauge@2.6.0

Then yarn upgrade.

node_modules
├─npm@3.10.10
│  ├─npmlog@4.0.2 // it is updated, but it requires "gauge": "~2.7.1"
│  │  ├─gauge@2.6.0

What is the expected behavior?

Not only update the version of npmlog, but also inner dependencies like gauge.

Please mention your node.js, yarn and operating system version.

node v6.9.1, OSX 0.11.6

Contributor guide

Tech stack
javascriptnodejs
Domain
toolingdeveloper experience
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
basic JavaScriptnpm/yarn experiencesemver understanding
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
45
Research direction
Investigate the yarn upgrade command implementation (likely in src/cli/commands/upgrade.js). Understand how it resolves and updates packages, especially transitive dependencies. Review comments in the issue for clues about the root cause. Consider testing with a minimal reproduction to verify the behavior.