Feature request: use ^ in instantsearch dependencies

[jlowcs]

Dependencies are fixed (4.75.7) instead of including minor/patches (^4.75.7), which makes it a pain to bump one dependency at a time.

For instance, if dependabot bumps instantsearch.js in our app, we end up with 2 versions of instantsearch.js within our node_modules since react-instantsearch was not bumped yet. Adding a ^ would fix this easily.

For instance: https://github.com/algolia/instantsearch/blob/master/packages/react-instantsearch/package.json#L52

[Haroenv]

You shouldn't need to update InstantSearch.js without also updating React InstantSearch, they are meant to be used with a 1:1 mapping of version (in a major version we might sync the version, but that's not sure). What use cases would you update InstantSearch.js without React InstantSearch too?

[jlowcs]

It's mostly an issue with dependabot bumping one dependency at a time. For now I've set up a dependabot group, but those are extremely slow to run so I try to avoid them if I can (otherwise our dependabot workflows time out).

If they're meant to be used with a 1:1 mapping of version, does that mean that you're not really following semantic versioning? Can a patch not really be just a patch?

It's also pretty unclear when those version are not in sync. In our case, I found out by chance. We had our app using instantsearch.js directly, as well as react-instantsearch which was referencing its own instantsearch.js. In the end, the first instantsearch.js (the most recent) ended up in our app bundle anyway.

[Haroenv]

Yes, in a future major we'll fix this and make it clearer what's dependent on what by using the exact same version numbers (and re-exporting everything so you'll only need "leaf" packages). In general it wouldn't be an issue to use a newer InstantSearch.js version than the React InstantSearch version (other way round could be an issue), but you'll end up with these duplicates.

So for now, keeping either no explicit dependency on InstantSearch.js and relying on the transitive dependency could work, or make sure they're grouped