The main package depends on different versions of subpackages

[hyrious]

Description

The main npm package video.js is depending on different versions of its sub-packages, causing users installing multiple copies of them. The duplicate packages are (for video.js 8.6.1):

@videojs/vhs-utils@3.0.5
@videojs/vhs-utils@4.0.0
m3u8-parser@6.2.0
m3u8-parser@7.1.0

Reduced test case

https://www.npmjs.com/package/video.js?activeTab=dependencies

Steps to reproduce

$ mkdir test-video.js && cd test-video.js
$ echo '{"dependencies":{"video.js":"*"}}' > package.json
$ pnpm i

dependencies:
+ video.js 8.6.1

Done in 4.2s

$ pnpm why m3u8-parser

dependencies:
video.js 8.6.1
├─┬ @videojs/http-streaming 3.7.0
│ └── m3u8-parser 7.1.0
└── m3u8-parser 6.2.0

$ pnpm why @videojs/vhs-utils

dependencies:
video.js 8.6.1
├─┬ @videojs/http-streaming 3.7.0
│ ├── @videojs/vhs-utils 4.0.0
│ ├─┬ aes-decrypter 4.0.1
│ │ └── @videojs/vhs-utils 3.0.5
│ ├─┬ m3u8-parser 7.1.0
│ │ └── @videojs/vhs-utils 3.0.5
│ └─┬ mpd-parser 1.2.2
│   └── @videojs/vhs-utils 3.0.5
├── @videojs/vhs-utils 4.0.0
├─┬ aes-decrypter 4.0.1
│ └── @videojs/vhs-utils 3.0.5
├─┬ m3u8-parser 6.2.0
│ └── @videojs/vhs-utils 3.0.5
└─┬ mpd-parser 1.2.2
  └── @videojs/vhs-utils 3.0.5

Errors

No response

What version of Video.js are you using?

8.6.1

Video.js plugins used.

No response

What browser(s) including version(s) does this occur with?

N/A

What OS(es) and version(s) does this occur with?

N/A

[welcome]

👋 Thanks for opening your first issue here! 👋

If you're reporting a 🐞 bug, please make sure you include steps to reproduce it. We get a lot of issues on this repo, so please be patient and we will get back to you as soon as we can.
To help make it easier for us to investigate your issue, please follow the contributing guidelines.

[boris-petrov]

Yes, I've been having overrides in my package.json forever because of that. It would be great to fix this issue!

[amtins]

@hyrious, @boris-petrov I've created the following PRs #8494, videojs/mpd-parser#178, videojs/m3u8-parser#182, videojs/aes-decrypter#88

I'm not sure I got them all, but I only had 30 minutes to spare. 😅