Surprises around `resolutions`

I encountered a few "surprises" around resolutions – not sure if those are expected but since I couldn't find them mentioned on GitHub yet, here they go.

Context

We're using graphql@14 in our project but one of the deep dependencies has a peerDependency on graphql@15, which results in a warning like this:

➤ YN0060: │ @company/my-package@workspace:my-package provides graphql (pc69a0) with version 14.7.0, which doesn't satisfy what @graphql-codegen/typescript-operations and some of its descendants request

The actual package that has this peerDependency is relay-compiler@10.0.1. Since we cannot upgrade graphql in our project, the "solution" (though not great) is to downgrade relay-compiler to 9.x which has peerDependency on graphql@14.

--save / -s doesn't work

I ran this command:

yarn set resolution --save relay-compiler@npm:10.0.1 9.1.0

This updated yarn.lock like this (will be important later):

"@graphql-tools/relay-operation-optimizer@npm:^6":
  version: 6.2.4
  resolution: "@graphql-tools/relay-operation-optimizer@npm:6.2.4"
  dependencies:
    relay-compiler: 10.0.1

"relay-compiler@npm:10.0.1":
  version: 9.1.0
  resolution: "relay-compiler@npm:9.1.0"
  dependencies: ...

But it didn't affect project-level package.json – I expected to find resolutions field there. According to this Discord reply, -s isn't implemented yet. Fair enough but I couldn't find the info here on GitHub so just want to mention it.

resolutions field in package.json doesn't update yarn.lock?

Since I wanted to have a mention of a version mapping in package.json and not just in yarn.lock, I updated the manifest manually:

{
  "name": "@company/project-root",
  "resolutions": {
    "relay-compiler": "9.1.0"
  }
}

I then reverted yarn.lock (I got rid of the changes done by yarn set resolution) and ran yarn (install).

At this point, I expected the yarn.lock to look exactly like above but this was the result instead:

"@graphql-tools/relay-operation-optimizer@npm:^6":
  version: 6.2.4
  resolution: "@graphql-tools/relay-operation-optimizer@npm:6.2.4"
  dependencies:
    relay-compiler: 10.0.1

"relay-compiler@npm:9.1.0":
  version: 9.1.0
  resolution: "relay-compiler@npm:9.1.0"
  dependencies: ...

The key point is that @graphql-tools/relay-operation-optimizer depends on relay-compiler@10.0.1 but this version 10.0.1 is nowhere to be found in the lockfile – the only key there is "relay-compiler@npm:9.1.0".

I guess in this case, Yarn consults both yarn.lock and package.json#resolutions to find out how to resolve relay-compiler but it feels strange to me – I'd expect the mapping to be obvious just from the lockfile itself.

Again, not sure if those are issues or expected behavior but they surprised me.

Reproduce the two cases described with package.json and yarn.lock: yarn set resolution --save relay-compiler@npm:10.0.1 9.1.0, then a manifest resolutions entry followed by yarn install. Start by tracing the resolution and lockfile handling entry points; done means the intended behavior and any required change are covered by tests or clearly documented.