Peer version pins

[kriskowal]

All @cosmjs packages are coversioned and pin their peer dependencies to the same exact version.

CosmJS packages also use TypeScript classes with private fields, which makes them particularly sensitive to identity and type discontinuity. That is to say, an application’s lockfile and node_modules tree can only have one version of each CosmJS package or they will see type errors of the form “Tendermint34 RPC client can’t be assigned to Tendermint34 RPC client because private field X is not X.” The only difference will be that the left and right Tendermint34 clients will come from different versions of the same package.

To that end, applications and libraries using CosmJS must also pin to the exact same version of each package and must not use semver ranges. That also means that any libraries being used with CosmJS must transitively be pinned so that any pair of libraries can reliably refer to the same instance.

At Agoric, we used a semver range for @cosmjs/stargate and @cosmjs/tendermint-rpc. That resulted in our packages receiving a newer version of tendermint-rpc than the one pinned in stargate, so stargate got its own version. This in turn resulted in type discontinuity errors. Semver ranges are the default behavior of yarn and npm when installing new packages.

This problem can be mitigated a number of ways:

1. (favored) CosmJS packages could use semver ranges for their dependencies on fellow CosmJS packages
2. CosmJS could loudly and virally document that all dependees must use a pinned version of all CosmJS packages and that they must post the same warning in the documentation of any libraries they publish, or risk dire but vague consequences.

[webmaster128]

Thank you for bringing this up. The change from "^foo" to "foo" came when migrating aways from Lerna and I never had a good argument for prefering one over the other. I think we can change that.

At Agoric, we used a semver range for @cosmjs/stargate and @cosmjs/tendermint-rpc. That resulted in our packages receiving a newer version of tendermint-rpc than the one pinned in stargate, so stargate got its own version.

What I am wondering is: why/how did you get a different version for @cosmjs/tendermint-rpc than @cosmjs/stargate? We release all packages for every new version.

[webmaster128]

The relevant yarn docs are here: https://yarnpkg.com/features/workspaces#publishing-workspaces. By specifying the path to the package our internal versions were turned into exact version.

[kriskowal]

That’s intriguing.

Upon further reflection, I cannot explain the effect I saw in terms of the model I described, so I must have missed something. That said, I’m sure using a semver range is not worse than pinning. Thank you for looking into this!

[webmaster128]

Shipped as part of CosmJS 0.29.0