`yarn add` of NPM registry module followed by Git URL results in duplicate yarn.lock entries

[markstos]

Do you want to request a feature or report a bug?

Bug.
What is the current behavior?

To reproduce the issue:

1. yarn add mocha-jenkins-reporter@0.2.5
2. yarn add 'juhovh/mocha-jenkins-reporter#e87c20655e2737205b76793e379154c953ab2b26'
3. Review yarn.lock and observe two entries for the package, one for the NPM repo version that is not used and one for the Github-hosted version that is us.

$ grep mocha-jenkins yarn.lock 
mocha-jenkins-reporter@0.2.5:
  resolved "https://registry.yarnpkg.com/mocha-jenkins-reporter/-/mocha-jenkins-reporter-0.2.5.tgz#7a2dd89da596c1dc0f1d041f24219110a4b0b887"
mocha-jenkins-reporter@juhovh/mocha-jenkins-reporter#e87c20655e2737205b76793e379154c953ab2b26:
  resolved "https://codeload.github.com/juhovh/mocha-jenkins-reporter/tar.gz/e87c20655e2737205b76793e379154c953ab2b26"

What is the expected behavior?

I would expect the same behavior if I had installed one npm-repo version followed by another package version hosted on the main NPM repo. For example, if I install the latest package version then downgrade it, I end up with one entry for the module in yarn.lock:

1. yarn add mocha-jenkins-reporter@0.3.1
2. yarn add mocha-jenkins-reporter@0.2.5

$ grep mocha-jenkins yarn.lock 
mocha-jenkins-reporter@0.2.5:
  resolved "https://registry.yarnpkg.com/mocha-jenkins-reporter/-/mocha-jenkins-reporter-0.2.5.tgz#7a2dd89da596c1dc0f1d041f24219110a4b0b887"

I tried to compare my results against detailed technical documentation for the data structure in yarn.lock, but found no such detailed documentation.

Please mention your node.js, yarn and operating system version.

• yarn 0.17.8
• Node 4.4.1
• Ubuntu Linux 16.04