yarnpkg/yarn

impossible to update package without pulling in updates of all dependencies

Open

#5,475 建立於 2018年3月7日

在 GitHub 查看
 (9 留言) (15 反應) (1 負責人)JavaScript (41,514 star) (2,731 fork)batch import
cat-buggood first issuehelp wantedtriaged

描述

Do you want to request a feature or report a bug? bug

What is the current behavior?

  1. there's a package.json, where "<packagename>": "~4.6.0", dependency is defined
  2. there's an entry in yarn.lock, which has the following lines:
"<packagename>@~4.6.0":
  version "4.6.73"
  resolved "https://<repository-url>/<packagename>-4.6.73.tgz#376e31e5ee9f7c6bb2c89d3921bfe7b24b6a75cf"
  dependencies:
    bootstrap-sass "^3.3.7"
    ember-bootstrap "^1.0.0"
    ember-bootstrap-datetimepicker "^1.1.0"
    ember-cli-babel "^5.1.7"
    ember-cli-htmlbars "^1.3.4"
    ember-cli-moment-shim "^3.5.0"
    ember-cli-string-helpers "^1.5.0"
    ember-component-css "^0.3.7"
    ember-config-service "^0.1.5"
    ember-font-awesome "^3.1.0"
    ember-moment "^7.4.1"
    ember-power-select "^1.10.4"
    ember-sticky-element "0.1.3"
    ember-truth-helpers "^2.0.0"
    eonasdan-bootstrap-datetimepicker "^4.17.47"
  1. there's a new version of <packagename> in repository (4.6.74)
  2. the only thing that is changed in the new version of <packagename> is package.json file (with version bumped). Just one number, no other changes at all.

There is no way to update <packagename> from 4.6.73 to 4.6.74 without updating all its dependencies

What is the expected behavior? With yarn 1.3.2 we could run yarn add <packagename>@~4.6.0 --force and the package would be updated correctly, in 1.5.1 this doesn't do anything. There's no other way of doing update like that (yarn update pulls updates for other dependencies which is unacceptable).

Please mention your node.js, yarn and operating system version.

yarn versions v1.5.1
{ yarn: '1.5.1',
  http_parser: '2.7.0',
  node: '6.10.2',
  v8: '5.1.281.98',
  uv: '1.9.1',
  zlib: '1.2.11',
  ares: '1.10.1-DEV',
  icu: '58.2',
  modules: '48',
  openssl: '1.0.2k' }

貢獻者指南

技術棧
nodejsjavascript
領域
clitooling
議題類型
bug
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
4
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
3-5 days
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
stale
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
clear
前置要求
Node.jsyarn internals
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
25
研究方向
The issue describes a bug in yarn 1.x where updating a single package to a minor version also forces updates to all its dependencies, violating semver. The repository is frozen; the fix should be considered for the yarnpkg/berry repository. The resolution logic in the lockfile needs to be examined, particularly how the yarn.lock file is generated and updated. The assignee may have insights; look at comments for any proposed solutions.
impossible to update package without pulling in updates of all dependencies · yarnpkg/yarn#5475 | Good First Issue