Enforcing shared dependencies in a monorepo

Question

We have a monorepo using lerna and yarn workspaces. Multiple teams contribute packages to it and there are some common dependencies where we want to force people to use the same version.

What are the options to force all packages to use the same version of specific dependencies? Is there a way to achieve that without writing custom scripts?

I want to prevent this situation:

my-repo/
  packages/
    pkg-A/
      package.json
        "address-validator": 1.1.0
    pkg-B/
      package.json
        "address-validator": 1.2.0

I know you can use lerna add or lerna run to add / upgrade in unison, but how to prevent an individual from unknowingly making their package unique?

Answer 1

I just noticed one nice solution to this problem in facebook's create-react-app. They import (all?) external dependencies in the react-dev-utils package and export them from there. Then all the other packages, like react-scripts, import dependencies from react-dev-utils.

This is nice because you only need to worry about using the latest version of one package (e.g. react-dev-utils) in order to use the latest version of all of the things you want to control. Also, it's flexible because you can override one of the dependencies by importing a different version directly.

So it could look like:

my-repo/
  packages/
    my-deps/
      pkg1.js // <--- module.exports = require("pkg1");
      package.json
        "pkg1": 1.2.0
    foo/
      index.js // <--- const pkg1 = require("my-deps/pkg1")
      package.json
        "my-deps": 1.1.0