chore: Ensure a single copy of @pulumi/pulumi dependency #178
Conversation
Having two versions of `@pulumi/pulumi` linked into the provider may cause problems.
See for example:
pulumi/pulumi#18057 (comment)
#177
Two versions of `@pulumi/pulumi` may be installed if `@pulumi/aws` dependency contradicts the direct dependency on that package.
This change takes advantage of a YARN specific feature called "resolutions" that will make sure that only one version,
the one specified in resolutions, is selected by YARN for the lockfile:
https://yarnpkg.com/lang/en/docs/selective-version-resolutions/
When using NPM, a similar feature is called overrides.
https://docs.npmjs.com/cli/v9/configuring-npm/package-json#overrides
|
Alternatively, I think if we have a model where |
|
The question is which is easier for Renovate to work with/configure properly? Does it understand to update "resolutions" or we can instead prefer to configure it to leave a version range in package.json here? |
|
CC @flostadler |
|
CC @corymhall |
|
You can check (and clean) duplicate entries in a yarn lock file using yarn-deduplicate. See how we're doing that in awsx: https://github.com/pulumi/pulumi-awsx/blob/0f52a8d59dfe7ad4949cfbca6750d7cca1c4960a/awsx/package.json#L22-L23 |
|
I think this makes more sense. I have done some searching:
Yarn v2 supports package deduplication natively, so yarn-deduplicate only works with Yarn v1 We use yarn v1 because it is the default on ubuntu-latest images it seems: The are some suggestions online that "resolutions" might backfire; also I am still not sure how to teach Renovate to bump "resolutions". So I will try this other alternative you are suggesting, use yarn-deduplicate and then I think we can ensure Renovate runs after touching this yarn.lock. |
Having two versions of
@pulumi/pulumilinked into the provider may cause problems.See for example:
Two versions of
@pulumi/pulumimay be installed if@pulumi/awsdependency contradicts the direct dependency on that package.This change takes advantage of a YARN specific feature called "resolutions" that will make sure that only one version, the one specified in resolutions, is selected by YARN for the lockfile:
https://yarnpkg.com/lang/en/docs/selective-version-resolutions/
When using NPM, a similar feature is called overrides.
https://docs.npmjs.com/cli/v9/configuring-npm/package-json#overrides