check-dependency-version-consistency

check-dependency-version-consistency

This plugin checks to ensure that dependencies are on consistent versions across a monorepo / yarn workspace. For example, every package in a workspace that has a dependency on eslint should specify the same version for it.

Motivation

• Supports a uniform developer experience. Like shared code formatting standards, consistent dependency versions reduce friction and make it easier for developers to jump around and work across packages in a monorepo.
• Discourages piecemeal upgrades. When possible, a dependency should be upgraded everywhere it exists in a monorepo at the same time. Upgrades are also simpler and easier to perform when fewer versions are present.
• Reduces unexpected behavior. Having old versions present can lead to confusion, e.g., a bug present in some parts of a monorepo but not others, or uncertainty about which version wins out when served to the browser.
• Cuts down on bundle size. Avoid serving excess dependency code to the browser.
• Saves disk space and installation time. Faster local development and CI.

Usage

To install:

yarn add --dev check-dependency-version-consistency

To run, use this command and optionally pass the path to the workspace root:

yarn check-dependency-version-consistency .

This can be incorporated as one of your package.json lint scripts like this:

{
  "lint": "npm-run-all --continue-on-error --aggregate-output --parallel lint:*",
  "lint:dependency-versions": "check-dependency-version-consistency .",
  "lint:js": "eslint . --cache",
}

If there are no dependency mismatches, the program will exit with success.

If there are any dependency mismatches, the program will exit with failure and output the mismatching versions:

Found 2 dependencies with mismatching versions across the workspace. Fix with `--fix`.
╔════════╤════════╤═════════════════════════════╗
║ eslint │ Usages │ Packages                    ║
╟────────┼────────┼─────────────────────────────╢
║ ^8.0.0 │ 1      │ @some-scope/package-name    ║
╟────────┼────────┼─────────────────────────────╢
║ ^7.0.0 │ 5      │ foo, bar, baz, and 2 others ║
╚════════╧════════╧═════════════════════════════╝
╔═════════╤════════╤════════════════════════════════════════╗
║ globby  │ Usages │ Packages                               ║
╟─────────┼────────┼────────────────────────────────────────╢
║ ^11.0.0 │ 2      │ packages/hello-world, packages/foo-bar ║
╟─────────┼────────┼────────────────────────────────────────╢
║ ^7.1.1  │ 1      │ packages/my-favorite-package           ║
╚═════════╧════════╧════════════════════════════════════════╝

Options

Name	Description
--fix	Whether to autofix inconsistencies (using highest version present).
--ignore-dep	Dependency to ignore mismatches for (option can be repeated).

Related

• npm-package-json-lint — use this complementary tool to enforce that your dependency versions use consistent range types (i.e. prefer-caret-version-ranges, prefer-caret-version-devDependencies)

Changelog

v1.4.2 (2021-12-08)

:bug: Bug Fix

• #275 Avoid crash when abnormal version present (@bmish)
• #271 Correctly expand globs in workspace paths (@bmish)

:house: Internal

• #253 Add GitHub Actions to Dependabot config (@ddzz)

Committers: 2

• Bryan Mishkin (@bmish)
• Darius D. (@ddzz)