Breaking changes in some of the recent minor releases of atlaskit packages

Atlassian Ecosystem Design
,
1

Hi,

Historically, auto-updating minor/patch versions of Atlaskit packages has been safe for our workflow. However, recent releases introduced unexpected breaking changes:

  • @atlaskit/modal-dialog (^14.4.1): A patch/minor bump broke modal layout constraints, causing overflow below the viewport with no scrollbar available. This severely impacted usability on lower-resolution screens in production.

  • @atlaskit/select (^21.3.3): Version 21.10.5 introduced a breaking UI change by automatically displaying avatars for options containing avatar data. Because this patch was published between our staging and production builds, staging passed with the older version while production broke.

Minor and patch updates shouldn’t introduce breaking functional or visual changes. Given these recent issues, we are forced to lock exact package versions to prevent unvetted changes from reaching production.

Any information about what’s happening with minor and patch updates recenlty would be greatly appeciated

2

Locking exact versions in package.json won’t be enough on its own. @atlaskit/select@21.10.5 declares 10 @atlaskit/* dependencies of its own, all on carets:

@atlaskit/icon ^34.0.0
@atlaskit/primitives ^19.0.0
@atlaskit/react-select ^3.15.0
@atlaskit/tokens ^13.0.0

Pin select and that subtree still floats, so the same class of visual change can arrive one level down.

The lockfile is the thing that covers the whole tree, and npm ci is what makes it authoritative. It installs the exact resolved versions from package-lock.json and ignores the ranges:

npm ci                          # yarn: --frozen-lockfile
                                # pnpm: --frozen-lockfile

Worth checking why staging and production diverged at all, though. From one committed lockfile that shouldn’t be possible, so either the pipeline is on npm install, or something regenerates the lock during the build, or the two ran from different commits. That’s the part I’d chase first, since it will bite again on a package that has nothing to do with Atlaskit.

On whether minor/patch should carry visual changes at all, no idea what the current policy is. That one needs someone from Atlassian.