Upcoming changes to npm / node-semver

[jamesplease]

There are two changes coming to npm that may require some changes in the way we specify grunt dependencies.

The first is the removal of peerDependencies. As you might already know, Grunt plugins typically specify their relationship to Grunt itself as a peerDep, so we'll need to figure out their new relationship.

The second change is an update to the behavior of the caret operator. Depending on our decision above we might also want to change this.

Regarding peerDependencies, we have at least three options:

1. Remove grunt from the dependencies altogether.
2. Add it to dependencies.
3. Add it to devDepedencies.

I'm not entirely confident with my understanding of the consequences of each of these choices, so I'm can't offer my opinion on which of these I think would be best.

Regarding the caret change:

The new behavior locks ^0.4.0 into 0.4.0 only, whereas it used to be equal to 0.4.x. So, if we'd like to continue having that same functionality as before, then I'd suggest we use 0.4.x. A similar alternative is ~0.4.0, which differs in that it also pulls in prereleases.

[cowboy]

Note that http://gruntjs.com/plugins currently uses peerDependencies to be able to display the version of Grunt there.

Are we using it, internally, anywhere else?

[tkellen]

We use it to display the expected grunt version when dynamically building READMEs.

[shama]

I think we should either remove it from peerDependencies or keep it and write a script to notify users of incompatible versions (maybe even part of grunt-cli).

Since only 1 instance of Grunt runs per Gruntfile adding to dependencies or devDependencies won't help. The user must install only one version of Grunt per project.

Creating a script that each of the contrib plugins runs upon install to notify the user of a possible incompatibility seems like the best approach, IMO. I wrote a proof of concept here: https://github.com/shama/peerdep

[shama]

As for the versioning, I think we should be super explicit and change ^0.5.0 to >=0.5.0 <0.6.0-0 to prevent future breaking changes. Here is library to help: https://github.com/rvagg/npm-explicit-deps

[shama]

Noting that the change in behavior of the caret operator was reverted: npm/node-semver@107ed7b

[shama]

With that this can now be closed as we have an issue opened already for handling peer dependencies: #1116