Allow dependency_overrides for dependencies of dependencies about sdk

[devoncarew]

My understanding of dependency_overrides is that is should force constraint resolution to use the indicated version (https://dart.dev/tools/pub/dependencies#dependency-overrides), irrespective of the version constraint specified in either your direct dependencies: section or the version constraint from any direct or transitive dep.

Can you confirm that you are seeing something different from this? Preferably via a minimal repro. Thanks!

[lukehutch]

@devoncarew Correct, based on the current usage of dependency_overrides, which affects only the dependencies of your own project.

I am proposing augmenting the pubspec.yaml syntax to add a new dependency_overrides section as a child of any dependency, so that the dependencies of the dependency can be forced to a specific version.

The "repro" is the bug report I linked. Basically, tyr depending upon firebase_admin: ^0.2.0 and http: ^1.0.0 in the same project, and you will see the problem. firebase_admin is compatible with http: ^1.0.0, but its own dependency on this is http: ^0.13.0, so you cannot use if your project needs http: ^1.0.0 (possibly because another dependency you are using depends upon it), you can't build your project, even though all the code would compile and work just fine with http: ^1.0.0.

Therefore, currently the only fix is to fork the firebase_admin project, change your fork's dependency to http: '>=0.13.0 <2.0.0', then change your project to depend upon your fork. This is a pain in the butt, and leads to a lot of different projects having to fork the same project just to get their build dependencies to resolve.

What I am proposing is allowing the user to override the version requirement of any dependency of any dependency of your project. This is not what dependency_overrides currently does. Look where I wrote dependency_overrides in the yaml example I gave. Currently you can't use dependency_overrides there. I am proposing that it should be allowed, for dependency-specific transitive dependency overrides.

[devoncarew]

@devoncarew Correct, based on the current usage of dependency_overrides, which affects only the dependencies of your own project.

To be clear, is does affect the transitive dependencies. dependency_overrides can be and is used to work around the problem of a dep not updating one of it's own dependencies. dependency_overrides lets you ignore the version constraints that your pubspec + transitive deps would otherwise impose on that dep.

https://github.com/dart-lang/sdk/wiki/Flutter-Pinned-Packages#i-see-issues-through-one-of-my-dependencies-but-they-cant-immediately-release-a-new-version mentions this as a way to get around periodic issues with flutter pinned packages.

[lukehutch]

To be clear, is does affect the transitive dependencies.

Ah, OK, thank you for explaining that. I jumped to the conclusion that I couldn't override dependencies in other packages using a directive in my own package. Thanks, I'll close this!