yarn.lock doesn't register package dependency correctly

[yoonwaiyan]

Bug description

This issue was filed at sysgears/webpack-virtual-modules#44 before reporting it here.

I installed React Storybook in my current project but one of the dependency, https://github.com/sysgears/webpack-virtual-modules , doesn't seem to add the debug dependency as stated in https://github.com/sysgears/webpack-virtual-modules/blob/665340a8c2ce240f1ed926d5ec706c7d83c2fca1/package.json#L38 . This is my entry of the dependency in the yarn.lock instead:

webpack-virtual-modules@^0.2.0:
  version "0.2.1"
  resolved "https://registry.yarnpkg.com/webpack-virtual-modules/-/webpack-virtual-modules-0.2.1.tgz#8ab73d4df0fd37ed27bb8d823bc60ea7266c8bf7"
  integrity sha512-0PWBlxyt4uGDofooIEanWhhyBOHdd+lr7QpYNDLC7/yc5lqJT8zlc04MTIBnKj+c2BlQNNuwE5er/Tg4wowHzA==

Command
It's a Rails project that I'm working on, so I encountered this issue while Rails is performing a $ yarn check with my webpacker gem versioned at 4.2.2 installed.

I've tried different ways to try make it work, including removing the webpack-virtual-modules entry from yarn.lock and run yarn install, reinstall @storybook/react, even tried removed node_modules to reinstall all dependencies but nothing seems to work.

What is the current behavior?

This is the output of yarn check when I tried to run my Rails project in my local environment:

error "@storybook/react#@storybook/core#webpack-virtual-modules#debug" is wrong version: expected "^3.0.0", got "2.6.9"

After discussion with @larixer over the discord server, it seems that the hoisting is broken. This is the output from @larixer while helping me out on this issue:

➜  1 jq -r '.dependencies' node_modules/webpack-virtual-modules/package.json
{
  "debug": "^3.0.0"
}
➜ ll node_modules/webpack-virtual-modules
total 48
-rw-r--r--  1 victor  staff   1.0K Apr 22 11:23 LICENSE
-rw-r--r--  1 victor  staff   4.0K Apr 22 11:23 README.md
-rw-r--r--  1 victor  staff   5.5K Apr 22 11:23 index.js
-rw-r--r--  1 victor  staff   1.0K Apr 22 11:23 package.json
-rw-r--r--  1 victor  staff   2.1K Apr 22 11:23 virtual-stats.js
➜  jq -r '.version' node_modules/debug/package.json
2.6.9

What is the expected behavior?
I'm expecting the correct dependencies to be registered, installed and loaded:

webpack-virtual-modules@^0.2.0:
  version "0.2.1"
  resolved "https://registry.yarnpkg.com/webpack-virtual-modules

/-/webpack-virtual-modules-0.2.1.tgz#8
ab73d4df0fd37ed27bb8d823bc60ea7266c8bf7"
  integrity sha512-0PWBlxyt4uGDofooIEanWhhyBOHdd+lr7QpYNDLC7/yc5lqJT8zlc04MTIBnKj+c2BlQNNuwE5er/Tg4wow
HzA==
  dependencies:
    debug "^3.0.0"

Steps to Reproduce
Attaching my package.json and yarn.lock for further inspection: debug.zip

Environment

• Node Version: v10.19.0
• Yarn v1 Version: 1.22.4
• OS and version: macOS Catalina 10.15.4

[larixer]

Additional context. I have tried to reproduce the problem and yes, the hoisting becomes broken, but it becomes broken because of the wrong entry in the yarn.lock for webpack-virtual-modules, after first install via yarn the correct entry for webpack-virtual-modules is written into yarn.lock, and after cleaning node_modules and running the second install, the hoisting layout becomes correct.

The main issue here is incorrect entry in yarn.lock for webpack-virtual-modules, but I cannot reproduce this main issue, yarn generates correct entry after install for me.