Skip to content

chore: pin peer dependency version ranges#566

Merged
ignaciosantise merged 1 commit into
developfrom
package-json-wildcard-risk
Jun 10, 2026
Merged

chore: pin peer dependency version ranges#566
ignaciosantise merged 1 commit into
developfrom
package-json-wildcard-risk

Conversation

@ignaciosantise

Copy link
Copy Markdown
Collaborator

Summary

Removes * wildcards from published package metadata so consumers installing the SDK via npm get bounded, predictable version ranges instead of "any version ever published."

Changes

  • packages/ethers & packages/wagmi — peerDependencies @react-native-community/netinfo and react-native-get-random-values changed from * to >=11.0.0 and >=1.11.0 respectively (floors match the versions this repo builds/tests against; consistent with the existing >= peer-dep convention).
  • root package.jsontsconfig devDependency pinned from * to 7.0.0 (latest; same version that was already resolving). Not published, but removes the only remaining wildcard in the repo's own install.
  • yarn.lock synced.

All regular dependencies in the published packages were already exact-pinned — no change needed there.

Notes

  • peerDependencies aren't installed into the SDK's own tree; they're declared for the host app. The benefit here is bounded metadata + a sane floor for npm 7+'s peer auto-install, rather than changing what the SDK itself pulls in.
  • Changeset bumps all 9 packages (patch) to keep versions aligned.

🤖 Generated with Claude Code

Replace `*` wildcards with bounded ranges in published packages and pin
the root tsconfig devDependency:

- packages/ethers, packages/wagmi: peerDependencies
  `@react-native-community/netinfo` and `react-native-get-random-values`
  changed from `*` to `>=11.0.0` / `>=1.11.0`
- root tsconfig devDependency `*` -> `7.0.0`

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@changeset-bot

changeset-bot Bot commented Jun 9, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: b3c8126

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 9 packages
Name Type
@reown/appkit-react-native Patch
@reown/appkit-bitcoin-react-native Patch
@reown/appkit-coinbase-react-native Patch
@reown/appkit-common-react-native Patch
@reown/appkit-core-react-native Patch
@reown/appkit-ethers-react-native Patch
@reown/appkit-solana-react-native Patch
@reown/appkit-ui-react-native Patch
@reown/appkit-wagmi-react-native Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@claude

claude Bot commented Jun 9, 2026

Copy link
Copy Markdown

Claude finished @ignaciosantise's task in 28s —— View job


PR Review

  • Gather context and read changed files
  • Run license compliance check
  • Run breaking changes check
  • Post final review

License compliance: ✅ No new dependencies introduced — only version range adjustments on pre-existing deps.

Found 2 issue(s)

Issue 1: peerDependency floor tightening may cause install-time failures for consumers on old netinfo versions

ID: brk-ethers-wagmi-netinfo-peerdep-floor-a3c2
File: packages/ethers/package.json:47, packages/wagmi/package.json:48
Severity: LOW
Category: breaking_change

Context:

  • Pattern: @react-native-community/netinfo peer dep changed from * (any version) to >=11.0.0 — tightening the declared compatibility constraint in a published package.
  • Risk: Consumers pinned below v11 (9.x, 10.x) will see peer dependency conflict errors/warnings from npm 7+ on install after upgrading the SDK. Strict installs may block entirely.
  • Impact: Those consumers were already broken at runtime if the SDK depends on v11 APIs, so the wildcard was a false promise — this makes the incompatibility explicit rather than silent.
  • Trigger: npm install / yarn install after upgrading to this SDK version.

Recommendation: The tightening is semantically correct. Consider whether patch is the right changeset bump level — tightening published peerDependency floors is technically a breaking change for the package manager resolver. minor would be more conservative. At minimum, call it out in the CHANGELOG so consumers know to check their @react-native-community/netinfo version.


Issue 2: peerDependency floor tightening may cause install-time failures for consumers on old react-native-get-random-values versions

ID: brk-ethers-wagmi-getrandomvalues-peerdep-floor-b7d4
File: packages/ethers/package.json:51, packages/wagmi/package.json:52
Severity: LOW
Category: breaking_change

Context:

  • Pattern: react-native-get-random-values changed from * to >=1.11.0 in two published packages.
  • Risk: Consumers pinned to 1.9.x or earlier will get peer dep conflict warnings on install.
  • Impact: Small population (minor semver distance), but those consumers need to upgrade this dep to proceed.
  • Trigger: npm install / yarn install after upgrading the SDK.

Recommendation: Same as above — the floor is accurate and should stay. Consider bumping the changeset from patch to minor given the consumer-visible install behavior change, or at minimum document the new minimums in the release notes.

Additional observation: The changeset bumps all 9 packages for version alignment, but only ethers and wagmi have published metadata changes. The other 7 packages (appkit-react-native, bitcoin, coinbase, common, core, solana, ui) get patch bumps purely for alignment — this is a valid choice if the team maintains synchronized versioning, just worth being intentional about it.

@ignaciosantise ignaciosantise marked this pull request as ready for review June 10, 2026 13:28
Copilot AI review requested due to automatic review settings June 10, 2026 13:28

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the monorepo’s published package metadata to avoid * wildcards by pinning peer dependency ranges (and one root devDependency) to explicit versions/ranges, aiming to make consumer installs more predictable.

Changes:

  • Replace * peerDependency wildcards with explicit lower-bounded ranges for @react-native-community/netinfo and react-native-get-random-values in the ethers and wagmi packages.
  • Pin the root tsconfig devDependency to 7.0.0.
  • Sync yarn.lock and add a Changeset to bump all packages (patch).

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
yarn.lock Updated lockfile to reflect the new peer/dev dependency constraints.
packages/wagmi/package.json Replaced wildcard peer deps with explicit version floors for netinfo + random-values.
packages/ethers/package.json Replaced wildcard peer deps with explicit version floors for netinfo + random-values.
package.json Pinned tsconfig devDependency from * to 7.0.0.
.changeset/cuddly-heads-type.md Adds a patch Changeset to keep package versions aligned.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +48 to +52
"@react-native-community/netinfo": ">=11.0.0",
"@walletconnect/react-native-compat": ">=2.16.1",
"react": ">=18",
"react-native": ">=0.72",
"react-native-get-random-values": "*",
"react-native-get-random-values": ">=1.11.0",
Comment on lines +46 to +50
"@react-native-community/netinfo": ">=11.0.0",
"@walletconnect/react-native-compat": ">=2.16.1",
"react": ">=18",
"react-native": ">=0.72",
"react-native-get-random-values": "*"
"react-native-get-random-values": ">=1.11.0"
@ignaciosantise ignaciosantise merged commit 9dc3a5c into develop Jun 10, 2026
13 checks passed
@ignaciosantise ignaciosantise deleted the package-json-wildcard-risk branch June 10, 2026 13:36
@github-actions github-actions Bot locked and limited conversation to collaborators Jun 10, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants