Q: Duplicate dependencies? nsfw@^1.2.9 and nsfw@^2.1.2

[kittaakos]

There are two incompatible nsfw dependencies in the dependency chain? Can someone please double-check? Thank you!

git rev-parse --short HEAD && yarn why nsfw
3420ef639e
yarn why v1.22.10
[1/4] 🤔  Why do we have the module "nsfw"...?
[2/4] 🚚  Initialising dependency graph...
[3/4] 🔍  Finding dependency...
[4/4] 🚡  Calculating file sizes...
=> Found "[email protected]"
info Reasons this module exists
   - "_project_#@theia#core" depends on it
   - Hoisted from "_project_#@theia#core#nsfw"
info Disk size without dependencies: "2.39MB"
info Disk size with unique dependencies: "3.24MB"
info Disk size with transitive dependencies: "3.24MB"
info Number of shared dependencies: 1
=> Found "@theia/eslint-plugin#[email protected]"
info Reasons this module exists
   - "_project_#@theia#eslint-plugin#@theia#core" depends on it
   - Hoisted from "_project_#@theia#eslint-plugin#@theia#core#nsfw"
info Disk size without dependencies: "1.84MB"
info Disk size with unique dependencies: "2.34MB"
info Disk size with transitive dependencies: "2.34MB"
info Number of shared dependencies: 1
✨  Done in 1.05s.

From yarn.lock:

theia/yarn.lock

Lines 1148 to 1152 in 3420ef6

	"@theia/[email protected]":
	version "1.11.0"
	resolved "https://registry.yarnpkg.com/@theia/core/-/core-1.11.0.tgz#0f1316652b8e513c1fe134089277921d1c161c3c"
	integrity sha512-G7ZJ7akYYCGjeG5d10vDEI54XtMWtINGdSpEnx1cK3a8iz7mPGkyDooYLvBU97L5Snxtvl1pBBwGtz9aMPq7JA==
	dependencies:

theia/yarn.lock

Line 1185 in 3420ef6

nsfw "^1.2.9"

theia/yarn.lock

Lines 9996 to 10008 in 3420ef6

	nsfw@^1.2.9:
	version "1.2.9"
	resolved "https://registry.yarnpkg.com/nsfw/-/nsfw-1.2.9.tgz#e49ff5c12593cbcce3fcc90c533947eb4f15a99a"
	integrity sha512-/2o89nygBRTTnGRxSHt2wjagbszyh36HlgF61Ec2iaJBTIIQ6QKcqp92EzVxxZX9U/6Qpy+LZL5i8532hXzAHg==
	dependencies:
	nan "^2.0.0"
	nsfw@^2.1.2:
	version "2.1.2"
	resolved "https://registry.yarnpkg.com/nsfw/-/nsfw-2.1.2.tgz#4fa841e7f7122b60b2e1f61187d1b57ad3403428"
	integrity sha512-zGPdt32aJ5b1laK9rvgXQmXGAagrx3VkcMt0JePtu6wBfzC1o4xLCM3kq7FxZxUnxyxYhODyBYzpt3H16FhaGA==
	dependencies:
	node-addon-api "*"

[vince-fugnitto]

cc @marechal-p I believe @theia/eslint-plugin does not get bumped during releases:

theia/dev-packages/eslint-plugin/package.json

Lines 1 to 9 in 3420ef6

	{
	"private": true,
	"name": "@theia/eslint-plugin",
	"version": "1.11.0",
	"description": "Custom ESLint rules for developing Theia extensions and applications",
	"dependencies": {
	"@theia/core": "1.11.0"
	}
	}

It pulls an older version of core which has an older version of nsfw.
I know that @theia/eslint-plugin is not published so downstream applications will not have two versions of nsfw.

[paul-marechal]

Oh wow. Nice catch, the package will actually be bumped but since I merged it after the release it kept the old ranges.