REPL provides wrong dependency version

[trash-and-fire]

REPL ignores versions of dependencies in package.json of imported packages.

https://svelte.dev/repl/75f0b64a56dc4bffb387b08a4441ccde?version=3.43.1

The lightweight-charts requires [email protected] but REPL tries to provide the latest version [email protected]

[non25]

This could silently break perfectly fine demo REPLs for complex published components without package maintainer ever noticing, unless someone post issue in the repo.
Sad state of things.

[dkwolfe4]

FWIW, I think that the issue was traced down to fancy-canvas being built with in a manner incompatible with the packaging library... see tradingview/lightweight-charts#488 and tradingview/lightweight-charts#613 The latter pull has not yet been incorporated into fancy-canvas as it breaks other TradingView software that depends on it.

[trash-and-fire]

We debugged the problem and found an interesting feature.

A similar replay of another framework handles dependency versions correctly: https://malinajs.github.io/repl/#/share/VO7aIokP-Od. The difference is that it requests packages from UNPKG using ?module parameter. With this parameter, all dependency imports are replaced with imports with exact package versions.

For example https://unpkg.com/[email protected]/dist/lightweight-charts.esm.production.js?module contains import { bindToDevicePixelRatio as t } from "https://unpkg.com/[email protected]/coordinate-space?module" and https://unpkg.com/[email protected]/dist/lightweight-charts.esm.production.js contains just import{bindToDevicePixelRatio as t}from"fancy-canvas/coordinate-space"

Perhaps you should use this parameter in Svelte REPL too?