Handling Dependency Version Drift in your Yarn Monorepo Just Became Easier

I just want to quickly tell you about a cool new feature I’ve built in Yarn. Specifically for yarn why. Since v4.14, asking Yarn why your monorepo depends on a dependency’s specific version has never been easier.

Imagine having a large Yarn monorepo which is maintained by multiple people. Maybe even multiple teams. Dependency version drift will happen and all of the sudden you have some packages depending onlodash@3.10.1 and others on lodash@4.18.1, without anybody noticing it.

By chance you find one of these packages which depend on the older version. You plan on migrating it and align all other packages, too. What would be the easiest way to find out which of your packages use the old version? You have the option to manually dig through yarn.lock.

Aint nobody got time for that!

You could use your favorite IDE’s global search for "lodash": , limit the results to package.json files only, and manually check the versions. Again: you have better thing to do with that time.

Then you realize there’s yarn why lodash which basically does the previous option, but quicker. Also — since your project is so large — you have way too many transitive dependencies, including lodash. The list of results is still too big to traverse manually. Wouldn’t it be convenient if you could filter the results to the specific version you’re looking for?

You can now run yarn why lodash@^3 to get a list of only packages which depend on the specified version. It may still give you results which aren’t applicable to your task, like transitive dependencies which also depend on lodash@^3. However, as promised, finding your own packages which depend on a specific dependency’s version is now that much easier.

Now you know which packages need some tender loving care.