updateInternalDependents incorrectly updates version of transitive devDependencies

[BPScott]

Problem

updateInternalDependents currently incorrectly triggers version updates on packages with transitive dependencies on devDependencies. I appreciate that is too terse to make sense, a demo is clearer:

The following demonstration with reproduction steps is available at https://github.com/BPScott/changesets-transitive-deps-bug

Consider a repository with 3 packages:

• package-a
• package-b - this has a devDependency on package-a
• package-c - this has a runtime dependency on package-b

package-a is the only package with a changeset associated with it.

Expected behaviour

When running npm run changset version, I would expect changsets to:

• Update package-a: Increase the version in the package.json and generate a CHANGELOG entry, as there is a changeset associated with this package.
• Update package-b: Update the devDependency version of package-a to the new version i the package.json. The version of package-b should be untouched as only a devDependency changed. No CHANGELOG entry is created as the version does not change.
• Not touch package-c's package.json. Because package-b's version was not updated there should be no change to package-c's package.json or CHANGELOG.

Actual Behaviour

The expected changes to package-a and package-b's both occur as expected.

However modifications are made to package-c, when there should be none, because there package-b did not receive a version bump.

package-c's version number is increased in the package.json. A changelog heading for the new version is generated, but no content is present.

Proposed solution

Changsets is currently smart enough to skip bumping the version of a package is when one of its devDependencies has changed. Because that package does not recieve a version bump, neither should any of its dependencies. I.e. in the above example - because package-b did not receive a version bump, then package-c should be have a version bump either.

[BPScott]

I tried changing the devDependency in package-b from ^1.0.0 to *.

When this occurs, package-b's package.json is no longer updated (this is expected behaviour), however the version in package-c continues to be (incorrectly) updated.

You can see that in action in the star-devdep branch of my reproduction repository.

[BPScott]

I've tried to dig into this in #949. I've not got an acutal fix, but I've wrote a set of failing tests that identify the problematic behaviour and what it should be doing. Hopefully that's useful as as a starting point for somebody else.

[Andarist]

@BPScott thank you for the report and the test cases - I will look into fixing this next week.