You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The issue occurs as a result of calling semver.coerce(version) to get the version of a package which looks like one of the following scenarios:
{
"typescript": "*", // wildcard, common in peerDependency field"typescript": "workspace:*", // common in monorepos"typescript": "latest", // or any other npm tag
}
This issue relates to the fact that we get package versions by reading a package.json file, which might not be a robust solution. Possible solutions to work on would be:
Change the way we read package versions by parsing the lock file instead. We could use tools such as nodejs-lockfile-parser for instance.
Change the way we read package versions by using package managers commands e.g. yarn why <dep>.
Create a wrapper of semver that deals with the scenario of “invalid” versions and falls back to another mechanism to retrieve the package version, or at least provide a better error message.
Add error handling around the places where we calculate versions, and gracefully handle the errors if needed (e.g. skip duplicated dependency check rather than crash)
The text was updated successfully, but these errors were encountered:
Error locations:
Suggested work:
The issue occurs as a result of calling
semver.coerce(version)
to get the version of a package which looks like one of the following scenarios:This issue relates to the fact that we get package versions by reading a package.json file, which might not be a robust solution. Possible solutions to work on would be:
yarn why <dep>
.semver
that deals with the scenario of “invalid” versions and falls back to another mechanism to retrieve the package version, or at least provide a better error message.The text was updated successfully, but these errors were encountered: