Skip to content

Allow versioned private packages to depend on skipped packages without requiring them to also be skipped#1842

Merged
Andarist merged 7 commits into
changesets:mainfrom
RodrigoHamuy:feat/apps-with-private-deps
Mar 2, 2026
Merged

Allow versioned private packages to depend on skipped packages without requiring them to also be skipped#1842
Andarist merged 7 commits into
changesets:mainfrom
RodrigoHamuy:feat/apps-with-private-deps

Conversation

@RodrigoHamuy
Copy link
Copy Markdown
Contributor

Fixes #906
Fixes #1093
Fixes #1167

Summary

Allow versioned private packages (apps) to depend on skipped/ignored packages without erroring.

Previously, changesets version would fail with "depends on the skipped package" even when the dependent was a private package that would never be published to npm. This fix applies to both the --ignore CLI flag (@changesets/cli) and the ignore config option (@changesets/config).

  • Added test in packages/cli/src/run.test.ts for the CLI validation path
  • Added test in packages/config/src/index.test.ts for the config validation path
  • Existing tests for non-private packages still correctly enforce the validation

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Feb 10, 2026

🦋 Changeset detected

Latest commit: 00d882d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages
Name Type
@changesets/config Patch
@changesets/cli Patch
@changesets/apply-release-plan Patch
@changesets/get-release-plan Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@RodrigoHamuy RodrigoHamuy changed the title allow ignore app dependencies Allow ignore app dependencies Feb 10, 2026
@codecov
Copy link
Copy Markdown

codecov Bot commented Feb 10, 2026

Codecov Report

❌ Patch coverage is 89.74359% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.84%. Comparing base (b6f4c74) to head (00d882d).
⚠️ Report is 20 commits behind head on main.

Files with missing lines Patch % Lines
packages/config/src/index.ts 88.88% 4 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1842      +/-   ##
==========================================
+ Coverage   81.33%   81.84%   +0.51%     
==========================================
  Files          54       55       +1     
  Lines        2277     2391     +114     
  Branches      679      722      +43     
==========================================
+ Hits         1852     1957     +105     
- Misses        420      429       +9     
  Partials        5        5              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@RodrigoHamuy RodrigoHamuy marked this pull request as ready for review February 10, 2026 16:10
Comment thread .changeset/private-deps-validation.md Outdated
"@changesets/config": patch
---

Allow versioned private packages to depend on skipped packages without requiring them to also be skipped. Private packages are not published to npm, so it is safe for them to have dependencies on ignored or unversioned packages.
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@RodrigoHamuy any reason why do you think only versioned private packages should be exempt of this validation?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No strong feelings, always simpler if it's up the the user. You mean we should also allow versioned public packages to depend on skipped pckages, right? Happy to action if you prefer

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually, I think as it is is correct. Publishing a dependency that depends on non-published libraries ain't gonna work.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You mean we should also allow versioned public packages to depend on skipped pckages, right?

No, I meant that we perhaps should allow unversioned private packages to depend on skipped packages. Those parhaps shouldn't reach the relevant functions on many occassions but I couldn't see a strong reason for gating the new behavior on config.privatePackages.version === true

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think unversioned private packages were already implicitly exempt — since they never go through the versioning pipeline, they wouldn't trigger this validation in practice. So the net new behavior is really for versioned private packages, which is what the changeset describes.

Happy to update the wording if you feel it's misleading, but I think it's accurate as-is.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll take care of the wording. That's not an issue. I just want to doublecheck the original intention of the PR. Notice that I already simplified the condition here - I'm just making sure it was the right call now.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Andarist personally I think it was better as it was before, as only if config.version is set we consider this an app and not a package based on the docs: https://github.com/changesets/changesets/blob/main/docs/versioning-apps.md

Copy link
Copy Markdown
Contributor Author

@RodrigoHamuy RodrigoHamuy Feb 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

but if it works, great!! But you may end up with published package.json files that depend on things that aren't being published (even if to a private registry). Not sure if that's OK? Maybe it is if they are devDependencies?

@Andarist
Copy link
Copy Markdown
Member

Overall, LGTM - but I asked one question that has to be resolved before we could land this. Pending the answer, we might have to adjust the added changeset and the docs change.

@Andarist Andarist changed the title Allow ignore app dependencies Allow versioned private packages to depend on skipped packages without requiring them to also be skipped Mar 2, 2026
@Andarist Andarist enabled auto-merge March 2, 2026 13:42
@Andarist Andarist added this pull request to the merge queue Mar 2, 2026
Merged via the queue into changesets:main with commit 6df3a5e Mar 2, 2026
6 checks passed
@github-actions github-actions Bot mentioned this pull request Mar 2, 2026
@RodrigoHamuy RodrigoHamuy deleted the feat/apps-with-private-deps branch March 7, 2026 17:59
nnecec pushed a commit to nnecec/changesets-docs that referenced this pull request Apr 16, 2026
…t requiring them to also be skipped (changesets#1842)

* allow skipping apps dependencies

* more fixes

* lint

* simplify

* tweak

* tweak

* edit changesets

---------

Co-authored-by: Mateusz Burzyński <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

2 participants