fix(deps): use workspace:^ to allow analytics-core dedupe (SDKW-8)#1740
Draft
fix(deps): use workspace:^ to allow analytics-core dedupe (SDKW-8)#1740
Conversation
Switch all @amplitude/* cross-package dependency specifiers from workspace:* to workspace:^ in published packages. With pnpm, workspace:* is replaced at publish time with the exact version of the workspace dependency (e.g. analytics-core@2.48.1). Because plugins inside analytics-browser are published at slightly different cadences, each ends up pinning a different exact version of analytics-core, which prevented the consumer's package manager from deduplicating it. Installing analytics-browser@2.42.1 produced two copies of analytics-core (e.g. 2.48.0 and 2.48.1) and shipped duplicated bundle code. Using workspace:^ tells pnpm to publish the dependency as a caret range (e.g. ^2.48.0), allowing consumers to dedupe to a single analytics-core install. Also bumps analytics-react-native's exact analytics-core pin to a caret range for the same reason. devDependencies and private package internals are left as workspace:* since they do not affect published consumer trees.
The deprecated-packages CI check disallows any code changes to packages/analytics-client-common. Revert the workspace:* -> workspace:^ specifier change there so the check passes. Other published packages keep the caret upgrade for analytics-core dedupe.
Session Replay Browser E2E Results
Details
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes SDKW-8: installing
@amplitude/analytics-browser@2.42.1ends up with two copies of@amplitude/analytics-core(e.g.2.48.0and2.48.1) because the SDK and its plugins each pin different exact versions ofanalytics-core.Root cause
All
@amplitude/*cross-package dependencies in this monorepo were declared as"workspace:*". With pnpm,workspace:*is rewritten to the exact version of the workspace dependency at publish time (e.g.2.48.1). Becauseanalytics-browserand each of its plugins are published at slightly different cadences vialerna(lerna.jsonhas"exact": true), every package ends up pinning a different exactanalytics-coreversion. Consumers' package managers therefore cannot dedupe and install multiple copies, bloating the bundle.Fix
Change every published package's
@amplitude/*runtime dependencies fromworkspace:*toworkspace:^. With pnpm,workspace:^is rewritten on publish to a caret range (e.g.^2.48.1), which lets npm/pnpm/yarn dedupe to a single sharedanalytics-core(and other) install.Also updates
@amplitude/analytics-react-native's exactanalytics-corepin (2.41.5) to a caret range (^2.41.5) for the same reason.packages/analytics-client-commonis intentionally not modified because it is on the deprecated-packages list andscripts/check-deprecated-packages.shblocks code changes there. Other plugins that depend onanalytics-client-commonstill benefit (their workspace specifier onanalytics-client-commonis now caret-based and consumers can dedupe to one copy).Verified locally by
pnpm pack-inganalytics-browserand inspecting the resultingpackage.json:devDependenciesand private/internal test packages were intentionally left asworkspace:*because they do not affect published consumer dependency trees.Checklist
Linear Issue: SDKW-8