[BUG]: Published package still require @octokit/core@5, which breaks peer dependency

[siketyan]

What happened?

Though

plugin-paginate-rest.js/package.json

Line 33 in 631e726

"@octokit/core": ">=6"

specifies @octokit/core@>=6 as peer dependency, the published package still require @octokit/core@5. This breaks peer dependency on our environment.

 ERR_PNPM_PEER_DEP_ISSUES  Unmet peer dependencies

.
├ @octokit/rest 21.0.0
├─┬ @octokit/plugin-paginate-rest 11.3.1
│ └── ✕ unmet peer @octokit/core@5: found 6.1.2 in @octokit/rest
└─┬ @octokit/plugin-rest-endpoint-methods 13.2.2
  └── ✕ unmet peer @octokit/core@^5: found 6.1.2 in @octokit/rest

❯ pnpm show @octokit/plugin-paginate-rest@11.3.1

@octokit/plugin-paginate-rest@11.3.1 | MIT | deps: 1 | versions: 109
Octokit plugin to paginate REST API endpoint responses
https://github.com/octokit/plugin-paginate-rest.js#readme

keywords: github, api, sdk, toolkit

dist
.tarball: https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-11.3.1.tgz
.shasum: fe92d04b49f134165d6fbb716e765c2f313ad364
.integrity: sha512-ryqobs26cLtM1kQxqeZui4v8FeznirUsksiA+RYemMPJ7Micju0WSkv50dBksTuZks9O5cg4wp+t8fZ/cLY56g==
.unpackedSize: 203.5 kB

(omit)

❯ curl -sL https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-11.3.1.tgz | tar -xf -
❯ cat package/package.json | jq '.peerDependencies'
{
  "@octokit/core": "5"
}

Versions

Node.js v20.15.0
pnpm v9.4.0

@octokit/core 6.1.2
@octokit/rest 21.0.0
@octokit/plugin-paginate-rest 11.3.1

Relevant log output

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[github-actions]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

[wolfy1339]

Please don't use 11.3.1

It's a special back port release for CJS users, which is not published to the main npm tag

The proper release to use is 11.3.0

[viceice]

@wolfy1339 that didn't solve anything. the package managers will resolve it to version v11.3.1 (at least pnpm)

[wolfy1339]

You can force your package manager to use whichever version you want. In the end you can manually edit your lockfile and package.json to suit your needs.

I triggered a new release that should fix the issue

[github-actions]

🎉 This issue has been resolved in version 11.3.3 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)

Your semantic-release bot 📦🚀

[siketyan]

Thank you for quick response and the new release!

Writing overrides in package.json resolved the problem for now:

{
  "pnpm": {
    "overrides": {
      "@octokit/plugin-paginate-rest": "11.3.0",
      "@octokit/plugin-rest-endpoint-methods": "13.2.1"
    }
  }
}

The new release also works.
A new release for plugin-rest-endpoint-methods would also be helpful.

[wolfy1339]

fyi, @viceice it's probable best not to have semantic-release in your dependencies, but rather use a tool like npx

It avoids all issues like this and any compability issues that arise when you use different Octokit versions that what semantic-release usees

[viceice]

fyi, @viceice it's probable best not to have semantic-release in your dependencies, but rather use a tool like npx

It avoids all issues like this and any compability issues that arise when you use different Octokit versions that what semantic-release usees

That would make things more complicated, because we need a lot plugins, which are not installed by default.

[wolfy1339]

We install plugins as devDependencies but not the core semantic-release packages here in Octokit

[gr2m]

That would make things more complicated, because we need a lot plugins, which are not installed by default.

I install plugins as needed as part of the release workflow. I wish there was something like releaseDependencies