@isaacs/nested-yarn-lock-test
v1.0.1
Published
This is an example case showing that a `yarn.lock` file does not guarantee package resolutions at all levels.
Readme
This is an example case showing that a yarn.lock file does not guarantee
package resolutions at all levels.
root ([email protected], [email protected], [email protected]) <-- 1.x dep here
+-- x 1.2.0 <-- 1.x resolves to 1.2.0
+-- y ([email protected], [email protected])
| +-- x 1.1.0 <-- 1.x resolves to 1.1.0
| +-- z 2.0.0 ([email protected]) <-- 1.x dep here
+-- z 1.0.0Both Yarn and npm create the same folder structure in node_modules, which
is good. But the yarn.lock file indicates that [email protected] should resolve to
version 1.2.0, and [email protected]'s dependency on [email protected] resolves to 1.1.0
instead.
Conclusion: yarn.lock on its own does not guarantee resolutions or
deterministic builds. That part of the contract is provided by the
implementation of Yarn itself, not in the lockfile format.