pnpm import from yarn lock changes sub-dependencies versions

[cant89]

Hi all,

I am facing an unwanted behaviour when trying to pnpm import from a yarn.lock (yarn v1).

The problem is that the resulted pnpm-lock.yaml contains a tree of dependencies which is in some parts different from the one in the yarn.lock, reason why is hard for me to release to production an app that have many, I don't know how many, sub-dependencies updated to unknown versions.

I'll try to explain what happens, taking as an example one of the packages I've found with this problem: classnames.
We don't have classnames as a dependency in our package.json, it is just dependency of many other dependencies. This is the yarn.lock portion in which classnames is defined:

[email protected], classnames@^2.2.1, classnames@^2.2.3, classnames@^2.2.6:
  version "2.3.1"
  resolved "https://registry.yarnpkg.com/classnames/-/classnames-2.3.1.tgz#dfcfa3891e306ec1dad105d0e88f4417b8535e8e"
  integrity sha512-OlQdbZ7gLfGarSqxesMesDa5uz7KFbID8Kpq/SxIoNGDqY8lSYs0D+hhtBXhcdB3rcbXArFr7vlHheLk1voeNA==

classnames@^2.2.5:
  version "2.2.6"
  resolved "https://registry.yarnpkg.com/classnames/-/classnames-2.2.6.tgz#43935bffdd291f326dad0a205309b38d00f650ce"
  integrity sha512-JR/iSQOSt+LQIWwrwEzJ9uk0xfN3mTVYMwt1Ir5mUcSN6pU+V4zQFFaJsclJbPuAUQH+yfWef6tm7l1quW3C8Q==

And down in the lock we can see that many packages are requiring the specific version ^2.2.5, resolved with the 2.2.6. All of them are modules like rc-table or rc-slider, dependencies of antd (Ant design library), except for one module which is installed in our package.json: @vx/shape

rc-table@~7.15.1:
  version "7.15.2"
  resolved "https://registry.yarnpkg.com/rc-table/-/rc-table-7.15.2.tgz#f6ab73b2cfb1c76f3cf9682c855561423c6b5b22"
  integrity sha512-TAs7kCpIZwc2mtvD8CMrXSM6TqJDUsy0rUEV1YgRru33T8bjtAtc+9xW/KC1VWROJlHSpU0R0kXjFs9h/6+IzQ==
  dependencies:
    classnames "^2.2.5"
     // ...other dependencies

"@vx/shape@^0.0.193":
  version "0.0.193"
  resolved "https://registry.yarnpkg.com/@vx/shape/-/shape-0.0.193.tgz#93af1ff8238912a99d97219b6c197ef821e92ca7"
  integrity sha512-Rawz7KktSO94AuFDvmJg0K7gkUXt8B9IPGGyI+Xyf99kiyQoCVxWZvdf3Z80RmxOkz8LhNFtu5c+RsJ9EIY8ew==
  dependencies:
    classnames "^2.2.5"
    // ...other dependencies

The antd package itself is also using classnames with another rule, ^2.2.6, which was then resolved with the 2.3.1 as seen above

antd@^4.16.11:
  version "4.16.11"
  resolved "https://registry.yarnpkg.com/antd/-/antd-4.16.11.tgz#924116b0de7370f914e9de6c8c5a4bf019b3d668"
  integrity sha512-7Tsx0sTjpSpgRqnXIRbuerqf4pu8+V1OPY4oZXXqTzuYPwKHdnbfXMg/L35IfeLtK1QcwgF4lfTR7bChJIcWSw==
  dependencies:
    classnames "^2.2.6"
    rc-table "~7.15.1"
    // ...other dependencies

You can also notice the presence of rc-table as a dependency of antd, as said before.

Now, the problem here is that antd is using the classnames version resolved to 2.3.1 while many of its dependencies, like rc-table, are using a different resolved version: the 2.2.6.
I mean, in the point in time in which I have updated antd the latest time, classnames had already released the 2.3.1 so how is it possible that the two rules ^2.2.6 (for antd) and ^2.2.5 (for rc-table) were resolved in two different ways even if installed in the same exact moment?

Well, my guess is that since @vx/shape was already installed specifying that classnames@^2.2.5 should resolve with 2.2.6, this rule was then inherited by rc-table even if unwanted.

And this is wrong.
I believe it is a wrong behaviour of yarn.

On the other hand, it looks like pnpm import correctly assign classnames 2.3.1 to rc-table but, I don't know why, also to @vx/shape. The version 2.2.6 of classnames is gone and not present at all in the pnpm lock.

So, what is my problem?

Problem is that I need to migrate respecting the exact tree of dependencies and pnpm is changing the version of classnames for both:

• rc-table, which can be appreciated and considered a better behaviour but still unwanted because can be cause of regressions
• @vx/shape which is unwanted at all

Does anyone have an idea on how to handle this scenario?

Thanks in advance for your time