Bot builder dependencies to other builder packages should use ~ versioning instead of ^

[msft-shahins]

Versions

All 4.x.x releases suffer from this issue

Describe the bug

Bot builder dependencies in packages.json are currently ^4.0.0 when importing other bot builder package dependencies, e.g. botbuilder-core. This causes having a hard dependency on exact versions of botbuilder, e.g. 4.0.8, to bring in latest version of botbuilder-core, e.g. 4.1.5, that might have some breaking changes.

To Reproduce

Have a dependency on botbuilder: "4.0.8" in your node project and see that botbuilder-core version will be "4.1.5" installed as dependency.

[johnataylor]

Given we are currently releasing the packages together we could happily set the dependency as exact.

[stevengum]

Jumping on @johnataylor's point, we also only test the latest bits together, we do not test cases between 4.0.8 and 4.1.5, let alone testing 4.1.4 with a dependency on 4.1.5.

@benbrown as someone more well versed in the ecosystem and what others are doing with their packages, can you chime in with your opinion?

FWIW, I support pinning to specific versions over sticking to patch releases (~).

[benbrown]

I'm not sure there is a strong established opinion about ^ vs ~ within intertwined packages like ours, but @johnataylor's reasoning rings true to me.

The only concern I have with this is that it requires us to more frequently update the package files - at every minor release instead of major. That's fine, but we should consider putting together a release checklist to keep track of this process.

[benbrown]

Ready for review!