common-versions.json

/**
 * This configuration file specifies NPM dependency version selections that affect all projects
 * in a Rush repo.  More documentation is available on the Rush website: https://rushjs.io
 */
{
  "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/common-versions.schema.json",

  /**
   * A table that specifies a "preferred version" for a given NPM package.  This feature is typically used
   * to hold back an indirect dependency to a specific older version, or to reduce duplication of indirect dependencies.
   *
   * The "preferredVersions" value can be any SemVer range specifier (e.g. "~1.2.3").  Rush injects these values into
   * the "dependencies" field of the top-level common/temp/package.json, which influences how the package manager
   * will calculate versions.  The specific effect depends on your package manager.  Generally it will have no
   * effect on an incompatible or already constrained SemVer range.  If you are using PNPM, similar effects can be
   * achieved using the pnpmfile.js hook.  See the Rush documentation for more details.
   *
   * After modifying this field, it's recommended to run "rush update --full" so that the package manager
   * will recalculate all version selections.
   */
  "preferredVersions": {
    /**
     * When someone asks for "^1.0.0" make sure they get "1.2.3" when working in this repo,
     * instead of the latest version.
     */
    // "some-library": "1.2.3"

    // This should be the TypeScript version that's used to build most of the projects in the repo.
    // Preferring it avoids errors for indirect dependencies that request it as a peer dependency.
    // It's also the newest supported compiler, used by most build tests and used as the bundled compiler
    // engine for API Extractor.
    "typescript": "~5.8.2",

    // This should be the ESLint version that's used to build most of the projects in the repo.
    "eslint": "~9.37.0",

    // Updated minimatch and its types to latest major version to resolve ReDoS vulnerability
    "minimatch": "10.2.3"
  },

  /**
   * When set to true, for all projects in the repo, all dependencies will be automatically added as preferredVersions,
   * except in cases where different projects specify different version ranges for a given dependency.  For older
   * package managers, this tended to reduce duplication of indirect dependencies.  However, it can sometimes cause
   * trouble for indirect dependencies with incompatible peerDependencies ranges.
   *
   * The default value is true.  If you're encountering installation errors related to peer dependencies,
   * it's recommended to set this to false.
   *
   * After modifying this field, it's recommended to run "rush update --full" so that the package manager
   * will recalculate all version selections.
   */
  // "implicitlyPreferredVersions": false,

  /**
   * If you would like the version specifiers for your dependencies to be consistent, then
   * uncomment this line. This is effectively similar to running "rush check" before any
   * of the following commands:
   *
   *   rush install, rush update, rush link, rush version, rush publish
   *
   * In some cases you may want this turned on, but need to allow certain packages to use a different
   * version. In those cases, you will need to add an entry to the "allowedAlternativeVersions"
   * section of the common-versions.json.
   *
   * In the case that subspaces is enabled, this setting will take effect at a subspace level.
   */
  "ensureConsistentVersions": true,

  /**
   * The "rush check" command can be used to enforce that every project in the repo must specify
   * the same SemVer range for a given dependency.  However, sometimes exceptions are needed.
   * The allowedAlternativeVersions table allows you to list other SemVer ranges that will be
   * accepted by "rush check" for a given dependency.
   *
   * IMPORTANT: THIS TABLE IS FOR *ADDITIONAL* VERSION RANGES THAT ARE ALTERNATIVES TO THE
   * USUAL VERSION (WHICH IS INFERRED BY LOOKING AT ALL PROJECTS IN THE REPO).
   * This design avoids unnecessary churn in this file.
   */
  "allowedAlternativeVersions": {
    // Allow Lockfile Explorer to support PNPM 9.x
    // TODO: Remove this after Rush adds support for PNPM 9.x
    "@pnpm/lockfile.types": ["1002.0.1"],
    "@typescript-eslint/parser": [
      "~6.19.0" // Used by build-tests/eslint-7(-*)-test / build-tests/eslint-bulk-suppressions-test-legacy
    ],
    "eslint": [
      "7.7.0", // Used by build-tests/eslint-7-7-test
      "7.11.0", // Used by build-tests/eslint-7-11-test
      "~7.30.0", // Used by build-tests/eslint-7-test
      "8.6.0", // Used by build-tests/eslint-bulk-suppressions-test-legacy
      "8.23.1", // Used by build-tests/eslint-bulk-suppressions-test-legacy
      "~8.57.0" // Used by build-tests/eslint-bulk-suppressions-test
    ],
    /**
     * For example, allow some projects to use an older TypeScript compiler
     * (in addition to whatever "usual" version is being used by other projects in the repo):
     */
    "typescript": [
      // "~5.0.4" is the (inferred, not alternative) range used by most projects in this repo

      // The oldest supported compiler, used by build-tests/api-extractor-lib1-test
      "~2.9.2",
      // For testing Heft with TS V3
      "~3.9.10",
      // For testing Heft with TS V4
      "~4.9.5",

      "5.8.2",
      // API Extractor bundles a specific TypeScript version because it calls internal APIs
      "5.9.3"
    ],
    "source-map": [
      "~0.6.1" // API Extractor is using an older version of source-map because newer versions are async
    ],
    "tapable": [
      "2.2.1",
      "1.1.3" // heft plugin is using an older version of tapable
    ],
    // --- For Webpack 4 projects ----
    "css-loader": ["~5.2.7"],
    "html-webpack-plugin": ["~4.5.2"],
    "postcss-loader": ["~4.1.0"],
    "sass-loader": ["~10.0.0"],
    "sass": ["~1.3.0"],
    "source-map-loader": ["~1.1.3"],
    "style-loader": ["~2.0.0"],
    "terser-webpack-plugin": ["~3.0.8"],
    "terser": ["~4.8.0"],
    "webpack": ["~4.47.0"],
    "webpack-dev-server": ["~4.9.3"],
    "@types/node": [
      // These versions are used by testing projects
      "ts2.9",
      "ts3.9",
      "ts4.9"
    ],
    "@types/jest": [
      // These versions are used by testing projects
      "ts2.9",
      "ts3.9",
      "ts4.9"
    ],
    "@rushstack/eslint-config": [
      // This is used by the ESLint 7 build tests
      "3.7.1"
    ],
    "@rushstack/set-webpack-public-path-plugin": [
      // This is used by the webpack 4 localization plugin tests
      "^4.1.16"
    ],
    "@pnpm/logger": [
      // For pnpm kit v8
      "~5.0.0",
      // For pnpm kit v9, v10
      "~1001.0.0"
    ],
    // These are used in heft-storybook-v6-react-tutorial-storykit and heft-storybook-v6-react-tutorial
    "@types/react": ["17.0.74"],
    "@types/react-dom": ["17.0.25"],
    "react": ["~17.0.2"],
    "react-dom": ["~17.0.2"],
    "@storybook/cli": ["~6.4.18"],
    "@storybook/react": ["~6.4.18"]
  }
}