feat(why): allow specifying a version or range (#6992)

remypar5 · clemyan · arcanis · web-flow · commit 97eaa4207102 · 2026-04-14T11:41:48.000+02:00
## What's the problem this PR addresses? Allowing users to specify a version or range for `yarn why` to find out why a specific version appears in the dependency tree. This is particularly useful if you want to address CVEs. Closes #6859 ## How did you fix it? - Check if a version/range is specified and handling it accordingly - For both simple and recursive mode ## Checklist  - [x] I have read the [Contributing Guide](https://yarnpkg.com/advanced/contributing).   - [x] I have set the packages that need to be released for my changes to be effective.   - [x] I will check that all automated PR checks pass before the PR gets reviewed. --------- Signed-off-by: Remy Parzinski <remypar5@users.noreply.github.com> Co-authored-by: Clement Yan <yanclement94@gmail.com> Co-authored-by: Maël Nison <nison.mael@gmail.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: arcanis <1037931+arcanis@users.noreply.github.com>
diff --git a/.yarn/versions/b4b98142.yml b/.yarn/versions/b4b98142.yml
@@ -0,0 +1,36 @@
+releases:
+  "@yarnpkg/cli": minor
+  "@yarnpkg/core": minor
+  "@yarnpkg/plugin-essentials": minor
+
+declined:
+  - "@yarnpkg/plugin-catalog"
+  - "@yarnpkg/plugin-compat"
+  - "@yarnpkg/plugin-constraints"
+  - "@yarnpkg/plugin-dlx"
+  - "@yarnpkg/plugin-exec"
+  - "@yarnpkg/plugin-file"
+  - "@yarnpkg/plugin-git"
+  - "@yarnpkg/plugin-github"
+  - "@yarnpkg/plugin-http"
+  - "@yarnpkg/plugin-init"
+  - "@yarnpkg/plugin-interactive-tools"
+  - "@yarnpkg/plugin-jsr"
+  - "@yarnpkg/plugin-link"
+  - "@yarnpkg/plugin-nm"
+  - "@yarnpkg/plugin-npm"
+  - "@yarnpkg/plugin-npm-cli"
+  - "@yarnpkg/plugin-pack"
+  - "@yarnpkg/plugin-patch"
+  - "@yarnpkg/plugin-pnp"
+  - "@yarnpkg/plugin-pnpm"
+  - "@yarnpkg/plugin-stage"
+  - "@yarnpkg/plugin-typescript"
+  - "@yarnpkg/plugin-version"
+  - "@yarnpkg/plugin-workspace-tools"
+  - "@yarnpkg/builder"
+  - "@yarnpkg/doctor"
+  - "@yarnpkg/extensions"
+  - "@yarnpkg/nm"
+  - "@yarnpkg/pnpify"
+  - "@yarnpkg/sdks"
diff --git a/packages/acceptance-tests/pkg-tests-fixtures/packages/why-no-deps-1.0.0/index.js b/packages/acceptance-tests/pkg-tests-fixtures/packages/why-no-deps-1.0.0/index.js
@@ -0,0 +1,7 @@
+module.exports = require(`./package.json`);
+
+for (const key of [`dependencies`, `devDependencies`, `peerDependencies`]) {
+  for (const dep of Object.keys(module.exports[key] || {})) {
+    module.exports[key][dep] = require(dep);
+  }
+}
diff --git a/packages/acceptance-tests/pkg-tests-fixtures/packages/why-no-deps-1.0.0/package.json b/packages/acceptance-tests/pkg-tests-fixtures/packages/why-no-deps-1.0.0/package.json
@@ -0,0 +1,4 @@
+{
+    "name": "why-no-deps",
+    "version": "1.0.0"
+}
diff --git a/packages/acceptance-tests/pkg-tests-fixtures/packages/why-no-deps-1.1.0/index.js b/packages/acceptance-tests/pkg-tests-fixtures/packages/why-no-deps-1.1.0/index.js
@@ -0,0 +1,7 @@
+module.exports = require(`./package.json`);
+
+for (const key of [`dependencies`, `devDependencies`, `peerDependencies`]) {
+  for (const dep of Object.keys(module.exports[key] || {})) {
+    module.exports[key][dep] = require(dep);
+  }
+}
diff --git a/packages/acceptance-tests/pkg-tests-fixtures/packages/why-no-deps-1.1.0/package.json b/packages/acceptance-tests/pkg-tests-fixtures/packages/why-no-deps-1.1.0/package.json
@@ -0,0 +1,4 @@
+{
+    "name": "why-no-deps",
+    "version": "1.1.0"
+}
diff --git a/packages/acceptance-tests/pkg-tests-fixtures/packages/why-no-deps-1.1.1/index.js b/packages/acceptance-tests/pkg-tests-fixtures/packages/why-no-deps-1.1.1/index.js
@@ -0,0 +1,7 @@
+module.exports = require(`./package.json`);
+
+for (const key of [`dependencies`, `devDependencies`, `peerDependencies`]) {
+  for (const dep of Object.keys(module.exports[key] || {})) {
+    module.exports[key][dep] = require(dep);
+  }
+}
diff --git a/packages/acceptance-tests/pkg-tests-fixtures/packages/why-no-deps-1.1.1/package.json b/packages/acceptance-tests/pkg-tests-fixtures/packages/why-no-deps-1.1.1/package.json
@@ -0,0 +1,4 @@
+{
+    "name": "why-no-deps",
+    "version": "1.1.1"
+}
diff --git a/packages/acceptance-tests/pkg-tests-fixtures/packages/why-no-deps-2.0.0/index.js b/packages/acceptance-tests/pkg-tests-fixtures/packages/why-no-deps-2.0.0/index.js
@@ -0,0 +1,7 @@
+module.exports = require(`./package.json`);
+
+for (const key of [`dependencies`, `devDependencies`, `peerDependencies`]) {
+  for (const dep of Object.keys(module.exports[key] || {})) {
+    module.exports[key][dep] = require(dep);
+  }
+}
diff --git a/packages/acceptance-tests/pkg-tests-fixtures/packages/why-no-deps-2.0.0/package.json b/packages/acceptance-tests/pkg-tests-fixtures/packages/why-no-deps-2.0.0/package.json
@@ -0,0 +1,4 @@
+{
+    "name": "why-no-deps",
+    "version": "2.0.0"
+}
diff --git a/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-1.0.0/index.js b/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-1.0.0/index.js
@@ -0,0 +1,7 @@
+module.exports = require(`./package.json`);
+
+for (const key of [`dependencies`, `devDependencies`, `peerDependencies`]) {
+  for (const dep of Object.keys(module.exports[key] || {})) {
+    module.exports[key][dep] = require(dep);
+  }
+}
diff --git a/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-1.0.0/package.json b/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-1.0.0/package.json
@@ -0,0 +1,7 @@
+{
+    "name": "why-range-dep",
+    "version": "1.0.0",
+    "dependencies": {
+        "why-no-deps": "^1.0.0"
+    }
+}
diff --git a/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-1.0.1/index.js b/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-1.0.1/index.js
@@ -0,0 +1,7 @@
+module.exports = require(`./package.json`);
+
+for (const key of [`dependencies`, `devDependencies`, `peerDependencies`]) {
+  for (const dep of Object.keys(module.exports[key] || {})) {
+    module.exports[key][dep] = require(dep);
+  }
+}
diff --git a/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-1.0.1/package.json b/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-1.0.1/package.json
@@ -0,0 +1,7 @@
+{
+    "name": "why-range-dep",
+    "version": "1.0.1",
+    "dependencies": {
+        "why-no-deps": "^1.0.1"
+    }
+}
diff --git a/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-1.1.0/index.js b/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-1.1.0/index.js
@@ -0,0 +1,7 @@
+module.exports = require(`./package.json`);
+
+for (const key of [`dependencies`, `devDependencies`, `peerDependencies`]) {
+  for (const dep of Object.keys(module.exports[key] || {})) {
+    module.exports[key][dep] = require(dep);
+  }
+}
diff --git a/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-1.1.0/package.json b/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-1.1.0/package.json
@@ -0,0 +1,7 @@
+{
+    "name": "why-range-dep",
+    "version": "1.1.0",
+    "dependencies": {
+        "why-no-deps": "^1.1.0"
+    }
+}
diff --git a/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-1.1.1/index.js b/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-1.1.1/index.js
@@ -0,0 +1,7 @@
+module.exports = require(`./package.json`);
+
+for (const key of [`dependencies`, `devDependencies`, `peerDependencies`]) {
+  for (const dep of Object.keys(module.exports[key] || {})) {
+    module.exports[key][dep] = require(dep);
+  }
+}
diff --git a/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-1.1.1/package.json b/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-1.1.1/package.json
@@ -0,0 +1,7 @@
+{
+    "name": "why-range-dep",
+    "version": "1.1.1",
+    "dependencies": {
+        "why-no-deps": "^1.1.1"
+    }
+}
diff --git a/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-2.0.0/index.js b/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-2.0.0/index.js
@@ -0,0 +1,7 @@
+module.exports = require(`./package.json`);
+
+for (const key of [`dependencies`, `devDependencies`, `peerDependencies`]) {
+  for (const dep of Object.keys(module.exports[key] || {})) {
+    module.exports[key][dep] = require(dep);
+  }
+}
diff --git a/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-2.0.0/package.json b/packages/acceptance-tests/pkg-tests-fixtures/packages/why-range-dep-2.0.0/package.json
@@ -0,0 +1,7 @@
+{
+    "name": "why-range-dep",
+    "version": "2.0.0",
+    "dependencies": {
+        "why-no-deps": "^2.0.0"
+    }
+}
diff --git a/packages/acceptance-tests/pkg-tests-specs/sources/commands/why.test.ts b/packages/acceptance-tests/pkg-tests-specs/sources/commands/why.test.ts
@@ -207,5 +207,195 @@ describe(`Commands`, () => {
         }]);
       }),
     );
+
+    describe(`with a specified version`, () => {
+      test(
+        `it should list workspaces using a specific version range`,
+        makeTemporaryEnv({
+          workspaces: [`packages/*`],
+        }, async ({path, run, source}) => {
+          await fs.writeJson(ppath.join(path, `packages/a/package.json`), {
+            name: `a`,
+            dependencies: {
+              [`b`]: `workspace:^`,
+              [`c`]: `workspace:^`,
+              [`why-no-deps`]: `1.0.0`,
+            },
+          });
+
+          await fs.writeJson(ppath.join(path, `packages/b/package.json`), {
+            name: `b`,
+            dependencies: {
+              [`why-no-deps`]: `1.1.0`,
+            },
+          });
+
+          await fs.writeJson(ppath.join(path, `packages/c/package.json`), {
+            name: `c`,
+            dependencies: {
+              [`why-no-deps`]: `2.0.0`,
+            },
+          });
+
+          await run(`install`);
+
+          const {stdout} = await run(`why`, `why-no-deps@^1.1.0`, `--json`);
+
+          // Don't list v1.0.0 (package A) nor v2.0.0 (package C)
+          expect(misc.parseJsonStream(stdout)).toEqual([{
+            value: `b@workspace:packages/b`,
+            children: {
+              [`why-no-deps@npm:1.1.0`]: {
+                descriptor: `why-no-deps@npm:1.1.0`,
+                locator: `why-no-deps@npm:1.1.0`,
+              },
+            },
+          }]);
+        }));
+
+      test(
+        `it should list workspaces transitively using a specific version range`,
+        makeTemporaryEnv({
+          workspaces: [`packages/*`],
+        }, async ({path, run, source}) => {
+          await fs.writeJson(ppath.join(path, `packages/a/package.json`), {
+            name: `a`,
+            dependencies: {
+              [`b`]: `workspace:^`,
+              [`why-range-dep`]: `1.0.0`,
+            },
+          });
+
+          await fs.writeJson(ppath.join(path, `packages/b/package.json`), {
+            name: `b`,
+            dependencies: {
+              [`c`]: `workspace:^`,
+              [`why-range-dep`]: `1.1.0`,
+            },
+          });
+
+          await fs.writeJson(ppath.join(path, `packages/c/package.json`), {
+            name: `c`,
+            dependencies: {
+              [`d`]: `workspace:^`,
+              [`why-range-dep`]: `1.1.1`,
+            },
+          });
+
+          await fs.writeJson(ppath.join(path, `packages/d/package.json`), {
+            name: `d`,
+            dependencies: {
+              [`why-range-dep`]: `2.0.0`,
+            },
+          });
+
+          await run(`install`);
+
+          const {stdout} = await run(`why`, `-R`, `why-no-deps@^1.1.0`, `--json`);
+
+          // Don't list v1.0.0 (package A) nor v2.0.0 (package D)
+          expect(stdout).not.toContain(`why-no-deps@npm:1.0.0`);
+          expect(stdout).not.toContain(`why-no-deps@npm:1.0.1`);
+          expect(stdout).not.toContain(`why-no-deps@npm:2.0.0`);
+
+          expect(misc.parseJsonStream(stdout)).toEqual([{
+            value: `a@workspace:packages/a`,
+            children: {
+              [`b@workspace:packages/b`]: {
+                children: {},
+                value: {
+                  descriptor: `b@workspace:^`,
+                  locator: `b@workspace:packages/b`,
+                },
+              },
+              [`why-range-dep@npm:1.0.0`]: {
+                value: {
+                  descriptor: `why-range-dep@npm:1.0.0`,
+                  locator: `why-range-dep@npm:1.0.0`,
+                },
+                children: {
+                  [`why-no-deps@npm:1.1.1`]: {
+                    children: {},
+                    value: {
+                      descriptor: `why-no-deps@npm:^1.0.0`,
+                      locator: `why-no-deps@npm:1.1.1`,
+                    },
+                  },
+                },
+              },
+            },
+          }, {
+            value: `b@workspace:packages/b`,
+            children: {
+              [`c@workspace:packages/c`]: {
+                children: {},
+                value: {
+                  descriptor: `c@workspace:^`,
+                  locator: `c@workspace:packages/c`,
+                },
+              },
+              "why-range-dep@npm:1.1.0": {
+                children: {
+                  "why-no-deps@npm:1.1.1": {
+                    children: {},
+                    value: {
+                      descriptor: `why-no-deps@npm:^1.1.0`,
+                      locator: `why-no-deps@npm:1.1.1`,
+                    },
+                  },
+                },
+                value: {
+                  descriptor: `why-range-dep@npm:1.1.0`,
+                  locator: `why-range-dep@npm:1.1.0`,
+                },
+              },
+            },
+          }, {
+            value: `c@workspace:packages/c`,
+            children: {
+              [`why-range-dep@npm:1.1.1`]: {
+                value: {
+                  descriptor: `why-range-dep@npm:1.1.1`,
+                  locator: `why-range-dep@npm:1.1.1`,
+                },
+                children: {
+                  [`why-no-deps@npm:1.1.1`]: {
+                    children: {},
+                    value: {
+                      descriptor: `why-no-deps@npm:^1.1.1`,
+                      locator: `why-no-deps@npm:1.1.1`,
+                    },
+                  },
+                },
+              },
+            },
+          }]);
+        }));
+
+      test(
+        `it should not list the packages with an out-of-range range specified`,
+        makeTemporaryEnv({
+          workspaces: [`packages/*`],
+        }, async ({path, run, source}) => {
+          await fs.writeJson(ppath.join(path, `package.json`), {
+            name: `a`,
+            dependencies: {
+              [`why-no-deps`]: `1.0.0`,
+            },
+          });
+          await run(`install`);
+
+          const {stdout} = await run(`why`, `why-no-deps@2.0.0`, `--json`);
+          return expect(stdout).toEqual(``);
+        }));
+
+      test(`it should fail with non-semver range specified`, makeTemporaryEnv({
+        workspaces: [`packages/*`],
+      }, async ({path, run, source}) => {
+        await run(`install`);
+        await expect(run(`why`, `why-no-deps@1.0.0`)).resolves.not.toThrow();
+        await expect(run(`why`, `irrelevant-dependency@invalid.range`)).rejects.toThrow();
+      }));
+    });
   });
 });
diff --git a/packages/plugin-essentials/sources/commands/why.ts b/packages/plugin-essentials/sources/commands/why.ts
diff --git a/packages/yarnpkg-core/sources/structUtils.ts b/packages/yarnpkg-core/sources/structUtils.ts

-Original file line number
+Diff line change
@@ @@ -0,0 +1,4 @@ @@
 +{
 +    "name": "why-no-deps",
 +    "version": "1.0.0"
 +}