Using constraints to enforce patches

[joshkel]

We'd like to enforce that our yarn patch resolutions are consistently applied to transitive dependencies. I looked into using the constraints feature to do this and didn't see a clear, obvious solution. I wanted to make sure I'm not missing anything before I open a feature request.

To provide a concrete example: We're using the docx package, and we're using the prosemirror-docx package, which depends on docx. Bad things happen if the versions don't match (if prosemirror-docx's docx dependency ends up resolving differently than docx). To further complicate things, we locally patch docx (using yarn patch).

We make this work by setting up our yarn resolutions appropriately:

"resolutions": {
    "prosemirror-docx/docx": "patch:docx@npm%3A8.5.0#~/.yarn/patches/docx-npm-8.5.0-c2ed7c0941.patch",
    "docx@^8.5.0": "patch:docx@npm%3A8.5.0#~/.yarn/patches/docx-npm-8.5.0-c2ed7c0941.patch"
}

But it would be nice to ensure that these stay in sync. I tried using the constraints feature to do this:

function ensureOneDocxInstance({ Yarn }) {
  const docx = Yarn.dependency({ ident: `docx` });
  const proseMirrorDocx = Yarn.dependency({ ident: `prosemirror-docx` });
  const proseMirrorDocxDocx = proseMirrorDocx?.resolution?.dependencies.get(`docx`);
  if (!docx || !proseMirrorDocx || !proseMirrorDocxDocx) {
    throw new Error('Failed to find docx or prosemirror-docx in the project');
  }
  if (docx.resolution.version !== proseMirrorDocxDocx.version) {
    proseMirrorDocx.error(
      'prosemirror-docx must depend on the same version of docx as the project'
    );
  }
}

This works for the unpatched case (prosemirror-docx uses docx 7.x, the project uses docx 8.x), but there doesn't appear to be a way to distinguish between a Package that has a patch applied and a Package that doesn't - they have identical version fields. (In other words, the ident: 'docx' Dependency has a range that indicates a patch, but I can't find a Dependency object for prosemirror-docx docx dependency to compare its range.)

The two Package instances have different object identities:

  if (docx.resolution !== proseMirrorDocxDocx) {
    proseMirrorDocx.error(
      'prosemirror-docx must depend on the same version of docx as the project'
    );
  }

But relying on that feels like a hack. Is there a better solution here?