npm caret clarification

[benomatis]

Maybe I'm misunderstanding something, but why would rnx-align-deps want to correct this while the RN 0.71 profile should normally allow it?

• jest "^29.5.0" should be "^29.2.1"

Isn't caret supposed to allow minor version changes?

[tido64]

Hi, I think I answered the same question here: #2086 (comment)

[tido64]

Why would I potentially end up with 2 versions?

Say you added "jest": "^29.2.1" and Yarn resolves to a specific version, for example 29.2.2. Some time later, someone else adds "jest": "^29.5.0" in another package. When Yarn resolves this version now, it will get 29.5.0. Yarn doesn't update the previous resolution as that would break the promise of the lockfile, so it adds another entry. Now you have two versions of Jest.

Why can I just not tell npm to upgrade (actually use the new version, and thus refer to it in yarn.lock), and to use the new version in package.json as well?

You can. As I mentioned in the other question, use yarn upgrade. You should also have a look at yarn-deduplicate. They have more information there as well.

[benomatis]

but if I keep 29.2.1, and the new package requirement upgrades it to 29.5.0, I could still end up with a 2 versions of jest if a third package comes, say, with 29.3.0, so what is this solving, really?

yarn upgrade will not resolve this, it will just silence depandabot and my consciousness that I'm on the latest and greatest...

[tido64]

^29.2.1 is a range. It's equivalent to telling package managers that any 29.x.x is good. You determine which version is installed by looking at your lockfile. You cannot determine this by just looking at package.json. align-deps ensures that your packages all declare the same range, thus ensuring that you have only a single entry of Jest for your packages in the lockfile. You can control what the package manager should resolve the version range to using yarn upgrade. If Dependabot is satisfied, it is because you ARE using the latest and greatest.

[kelset]

you can learn more here: https://github.com/npm/node-semver

[benomatis]

Thank you, guys, I guess I'll have to do some more reading, but it's not really anything specific to this package.