NPM Package versioning and constraint settings

[peterwilsoncc]

While working on #52444 to resolve an issue with syncing packages maintained in the Gutenberg repository to WordPress releasees, I noticed an apparent mismatch between how packages were versioned and the contraints of dependencies were defined.

The last few releases of the Gutenberg plugin include the following versions of the block-editor and components packages:

Gutenberg 16.2

• block-editor: 12.5.0
• components: 25.3.0

Gutenberg 16.1

• block-editor: 12.3.0
• components: 25.1.0

Gutenberg 16.0

• block-editor: 12.3.0
• components: 25.1.0

In each version of the released packages the block editor lists the dependency constrain for the components package as ^25.x.x -- the specific minor and patch versions are immaterial -- resulting in an allowed range of >=25.x.x <26.0.0-0 per the npm docs

This can result in a mismatch of Gutenberg versions when attempting to install a package targeting a particular plugin release. The command npm install @wordpress/[email protected] will install components version 25.3.0 at the time of writing.

While reviewing package bumps for WordPress 6.3 in WordPress/wordpress-develop#4699, I noticed similar minor version bumps with major version constraints. Although I think the syncing script tries to handle this.

To ensure version constraints match expectations, I think there needs to be a rethink of how the package versions are bumped.

To ensure consumers of packages get the expected versions of packages I propose:

• Each Gutenberg plugin release do a major bump of all packages (altered or not), or,
• Constraints be modified in the built file to tilde ranges, eg ~25.1.x := >=25.1.x <25.2.0-0

Coincidentally, while I was drafting this yesterday @noahtallen reported hitting the issue in #46693 (comment)

CC @youknowriad @gziolo @mcsf @noisysocks @priethor @aristath @adamziel @carolinan @tellthemachines @talldan @georgeh @artemiomorales @kevin940726 @ramonjd @andrewserong @ellatrix (I copied this list from #46693, let me know I others ought to be pinged)

[gziolo]

There was a network issue during npm publishing for Gutenberg 16.2. It looks like the commit with version bumps for packages wasn’t backported to the wp/6.3 branch and it’s using minor versions from 16.1. Otherwise, everything looks good.

[noahtallen]

I think I remember this -- I even opened this PR (#52145) because package versions on npm were mismatched with the repository. But the subsequent release resolved the issue.