Package.json version management

It's been more than a year I'm using React-Admin Library for multiple projects and I really like how this library helping me building Admin and Dashboard interfaces 🎉 😍

But, I often faced on react-admin dependencies version management issues. It appear that, without even changing react-admin version (fixed version in my package.json file) and executing from scratch install (yarn install) on my project (without a yarn.lock file or node_modules folder), result in errors if one or more new versions of dependencies had been released and has changes that are in conflict with my current react-admin version.

This is mostly due to allowing automatic updates to the latest minor version for react-admin dependencies (^x.x.x).

Last recent example is with ra-ui-materialui where, without updating react-admin version in my package.json, I've done a fresh install of my project and the compilation failed because ra-ui-materialui has a new minor version, 4.11.0, and now Typescript throw errors related to the render prop of a FunctionField I'm using.

Another significant example happened few months ago with react-router-dom where for a previous react-admin version, a new minor version of react-router[-dom] has been released (6.10.x) and has caused failure on my project. Here again, I didn't change the react-admin version on my side and I was stuck with this error few days (because I wasn't aware that the react-router[-dom] has been updated because nothing changed in my package.json file and the error was not clear but it's another problem)

This also causing issue during my deployment process because a from scratch install is done on my side.

What you were expecting

Having my React-Admin project not breaking when I'm doing a from scratch install of my project, when I'm not touching my react-admin version which is fixed in my package.json.

What happened instead

Doing a from scratch install of my project resulting some times by a project broken because dependencies had a new minor version released

Steps to reproduce and Related Code

The use of ^ for packages version in the package.json file of react-admin :

"dependencies": {
        "@emotion/react": "^11.4.1",
        "@emotion/styled": "^11.3.0",
        "@mui/icons-material": "^5.0.1",
        "@mui/material": "^5.0.2",
        "history": "^5.1.0",
        "ra-core": "^4.10.2",
        "ra-i18n-polyglot": "^4.10.2",
        "ra-language-english": "^4.10.2",
        "ra-ui-materialui": "^4.10.2",
        "react-hook-form": "^7.40.0",
        "react-router": "^6.1.0",
        "react-router-dom": "^6.1.0"
    },

Here is my current package.json to avoid having surprises :

"resolutions": {
    "@emotion/react": "11.10.6",
    "@emotion/styled": "11.10.6",
    "@mui/icons-material": "5.11.11",
    "@mui/material": "5.12.0",
    "@mui/styles": "5.12.0",
    "@mui/utils": "5.12.0",
    "react-router": "6.9.0",
    "react-router-dom": "6.9.0",
    "ra-core": "4.10.2",
    "ra-ui-materialui": "4.10.2"
  },
  "dependencies": {
    "@emotion/react": "11.10.6",
    "@emotion/styled": "11.10.6",
    "@mui/icons-material": "5.11.11",
    "@mui/material": "5.12.0",
    "@mui/styles": "5.12.0",
    "ra-data-fakerest": "4.8.3",
    "ra-data-simple-rest": "4.8.3",
    "react": "18.2.0",
    "react-admin": "4.10.2",
    "react-dom": "18.2.0",
    "react-query": "3.39.3",
    "react-router-dom": "6.9.0",
    "react-scripts": "5.0.1",
    "typescript": "4.7.4",
    "web-vitals": "2.1.0"
  },

Other information

Automatic minor update shouldn't be allowed in your project regarding the dependencies you have, I would suggest at least allowing automatic patch version (~) or a fixed version in this case.

Btw, I love the project and what you React-Admin team are doing ! 😘 🇫🇷

Environment

• React-admin version: 4.10.2
• React version: 18.2
• Browser: Chromium

Start by inspecting the repository's package.json dependency declarations and any release or versioning configuration. Compare the requested dependency version policy with fresh installs and existing build checks; done means the chosen policy is agreed on and prevents unintended dependency updates without breaking the project.