feat(requirements): add unified-dependency-versions requirement to detect version drift

Add a new repo-scoped requirement that verifies all external (non-workspace)
dependencies use the same version specifier across all workspaces in the monorepo.

- Scans all workspace package.json files for dependencies and devDependencies
- Reports when the same package has different version specifiers in different workspaces
- Supports fix mode to auto-align versions to the most frequently used specifier
- Includes allowlist for known intentional version differences (major version migrations)
- Runs automatically on every PR via the existing check-code-validation workflow

Agent-Logs-Url: https://github.com/trezor/trezor-suite/sessions/cd558aa1-bb58-48d3-add8-a0355636ead6

Co-authored-by: mroz22 <30367552+mroz22@users.noreply.github.com>

Author: Copilot

packages/requirements/src/__tests__/requireUnifiedDependencyVersions.test.ts

@@ -0,0 +1,276 @@
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { requireUnifiedDependencyVersions } from '../requirements/dependency-versions/requireUnifiedDependencyVersions';
+
+const tempDirs: string[] = [];
+
+afterEach(() => {
+    for (const dir of tempDirs) {
+        rmSync(dir, { recursive: true, force: true });
+    }
+    tempDirs.length = 0;
+});
+
+const createTempRepo = () => {
+    const root = mkdtempSync(join(tmpdir(), 'req-dep-test-'));
+    tempDirs.push(root);
+
+    return {
+        root,
+        addWorkspace: (
+            name: string,
+            location: string,
+            deps: Record<string, string> = {},
+            devDeps: Record<string, string> = {},
+        ) => {
+            const dir = join(root, location);
+            mkdirSync(dir, { recursive: true });
+
+            const pkg: Record<string, unknown> = { name };
+
+            if (Object.keys(deps).length > 0) {
+                pkg.dependencies = deps;
+            }
+
+            if (Object.keys(devDeps).length > 0) {
+                pkg.devDependencies = devDeps;
+            }
+
+            writeFileSync(join(dir, 'package.json'), JSON.stringify(pkg, null, 4) + '\n');
+        },
+        setRootPackageJson: (
+            workspaces: string[],
+            deps: Record<string, string> = {},
+            devDeps: Record<string, string> = {},
+        ) => {
+            const pkg: Record<string, unknown> = {
+                name: 'test-monorepo',
+                workspaces: { packages: workspaces },
+            };
+
+            if (Object.keys(deps).length > 0) {
+                pkg.dependencies = deps;
+            }
+
+            if (Object.keys(devDeps).length > 0) {
+                pkg.devDependencies = devDeps;
+            }
+
+            writeFileSync(join(root, 'package.json'), JSON.stringify(pkg, null, 4) + '\n');
+        },
+    };
+};
+
+describe('requireUnifiedDependencyVersions', () => {
+    it('reports no errors when all versions match', async () => {
+        const repo = createTempRepo();
+        repo.setRootPackageJson(['packages/*']);
+        repo.addWorkspace('@test/alpha', 'packages/alpha', { lodash: '^4.17.21' });
+        repo.addWorkspace('@test/beta', 'packages/beta', { lodash: '^4.17.21' });
+
+        const errors = await requireUnifiedDependencyVersions.verify({ repoRoot: repo.root });
+
+        expect(errors).toEqual([]);
+    });
+
+    it('ignores dependencies in the allowed drifts list', async () => {
+        const repo = createTempRepo();
+        repo.setRootPackageJson(['packages/*']);
+        // 'react' is in ALLOWED_DRIFTS
+        repo.addWorkspace('@test/alpha', 'packages/alpha', { react: '18.2.0' });
+        repo.addWorkspace('@test/beta', 'packages/beta', { react: '19.2.4' });
+
+        const errors = await requireUnifiedDependencyVersions.verify({ repoRoot: repo.root });
+
+        expect(errors).toEqual([]);
+    });
+
+    it('reports errors when versions differ', async () => {
+        const repo = createTempRepo();
+        repo.setRootPackageJson(['packages/*']);
+        repo.addWorkspace('@test/alpha', 'packages/alpha', { lodash: '^4.17.15' });
+        repo.addWorkspace('@test/beta', 'packages/beta', { lodash: '^4.17.21' });
+
+        const errors = await requireUnifiedDependencyVersions.verify({ repoRoot: repo.root });
+
+        expect(errors).toHaveLength(1);
+        expect(errors[0]).toContain('"lodash"');
+        expect(errors[0]).toContain('^4.17.15');
+        expect(errors[0]).toContain('^4.17.21');
+    });
+
+    it('reports errors across dependencies and devDependencies', async () => {
+        const repo = createTempRepo();
+        repo.setRootPackageJson(['packages/*']);
+        repo.addWorkspace('@test/alpha', 'packages/alpha', { express: '4.18.0' });
+        repo.addWorkspace('@test/beta', 'packages/beta', {}, { express: '^4.17.0' });
+
+        const errors = await requireUnifiedDependencyVersions.verify({ repoRoot: repo.root });
+
+        expect(errors).toHaveLength(1);
+        expect(errors[0]).toContain('"express"');
+    });
+
+    it('ignores workspace: protocol references', async () => {
+        const repo = createTempRepo();
+        repo.setRootPackageJson(['packages/*']);
+        repo.addWorkspace('@test/alpha', 'packages/alpha', { '@test/beta': 'workspace:*' });
+        repo.addWorkspace('@test/beta', 'packages/beta', { '@test/alpha': 'workspace:^' });
+
+        const errors = await requireUnifiedDependencyVersions.verify({ repoRoot: repo.root });
+
+        expect(errors).toEqual([]);
+    });
+
+    it('ignores git/file/link references', async () => {
+        const repo = createTempRepo();
+        repo.setRootPackageJson(['packages/*']);
+        repo.addWorkspace('@test/alpha', 'packages/alpha', {
+            'some-pkg': 'github:user/repo#v1',
+        });
+        repo.addWorkspace('@test/beta', 'packages/beta', {
+            'some-pkg': 'github:user/repo#v2',
+        });
+
+        const errors = await requireUnifiedDependencyVersions.verify({ repoRoot: repo.root });
+
+        expect(errors).toEqual([]);
+    });
+
+    it('reports no error when a dependency is used in only one workspace', async () => {
+        const repo = createTempRepo();
+        repo.setRootPackageJson(['packages/*']);
+        repo.addWorkspace('@test/alpha', 'packages/alpha', { lodash: '^4.17.21' });
+        repo.addWorkspace('@test/beta', 'packages/beta', { express: '^4.18.0' });
+
+        const errors = await requireUnifiedDependencyVersions.verify({ repoRoot: repo.root });
+
+        expect(errors).toEqual([]);
+    });
+
+    it('reports multiple drifted dependencies', async () => {
+        const repo = createTempRepo();
+        repo.setRootPackageJson(['packages/*']);
+        repo.addWorkspace('@test/alpha', 'packages/alpha', {
+            lodash: '^4.17.15',
+            express: '4.18.0',
+        });
+        repo.addWorkspace('@test/beta', 'packages/beta', {
+            lodash: '^4.17.21',
+            express: '4.19.0',
+        });
+
+        const errors = await requireUnifiedDependencyVersions.verify({ repoRoot: repo.root });
+
+        expect(errors).toHaveLength(2);
+    });
+
+    it('detects drift between root package.json and workspace', async () => {
+        const repo = createTempRepo();
+        repo.setRootPackageJson(['packages/*'], { lodash: '^4.17.15' });
+        repo.addWorkspace('@test/alpha', 'packages/alpha', { lodash: '^4.17.21' });
+
+        const errors = await requireUnifiedDependencyVersions.verify({ repoRoot: repo.root });
+
+        expect(errors).toHaveLength(1);
+        expect(errors[0]).toContain('"lodash"');
+        expect(errors[0]).toContain('test-monorepo');
+        expect(errors[0]).toContain('^4.17.15');
+        expect(errors[0]).toContain('^4.17.21');
+    });
+
+    it('supports flat workspaces array', async () => {
+        const repo = createTempRepo();
+        // Use flat array format instead of { packages: [...] }
+        writeFileSync(
+            join(repo.root, 'package.json'),
+            JSON.stringify({ name: 'test-monorepo', workspaces: ['packages/*'] }, null, 4) + '\n',
+        );
+        repo.addWorkspace('@test/alpha', 'packages/alpha', { lodash: '^4.17.15' });
+        repo.addWorkspace('@test/beta', 'packages/beta', { lodash: '^4.17.21' });
+
+        const errors = await requireUnifiedDependencyVersions.verify({ repoRoot: repo.root });
+
+        expect(errors).toHaveLength(1);
+    });
+
+    it('reports error for workspace with invalid package.json', async () => {
+        const repo = createTempRepo();
+        repo.setRootPackageJson(['packages/*']);
+        repo.addWorkspace('@test/alpha', 'packages/alpha', { lodash: '^4.17.21' });
+
+        // Create a workspace with invalid JSON
+        mkdirSync(join(repo.root, 'packages/broken'), { recursive: true });
+        writeFileSync(join(repo.root, 'packages/broken/package.json'), '{ invalid json');
+
+        const errors = await requireUnifiedDependencyVersions.verify({ repoRoot: repo.root });
+
+        expect(errors.some(e => e.includes('packages/broken/package.json'))).toBe(true);
+    });
+
+    describe('fix mode', () => {
+        it('aligns all versions to the most common one', async () => {
+            const repo = createTempRepo();
+            repo.setRootPackageJson(['packages/*']);
+            repo.addWorkspace('@test/alpha', 'packages/alpha', { lodash: '^4.17.21' });
+            repo.addWorkspace('@test/beta', 'packages/beta', { lodash: '^4.17.21' });
+            repo.addWorkspace('@test/gamma', 'packages/gamma', { lodash: '^4.17.15' });
+
+            const errors = await requireUnifiedDependencyVersions.fix!({ repoRoot: repo.root });
+
+            expect(errors).toEqual([]);
+
+            // Verify the file was updated
+            const gammaPkg = JSON.parse(
+                readFileSync(join(repo.root, 'packages/gamma/package.json'), 'utf-8'),
+            );
+            expect(gammaPkg.dependencies.lodash).toBe('^4.17.21');
+        });
+
+        it('picks numerically higher version when frequencies are tied', async () => {
+            const repo = createTempRepo();
+            repo.setRootPackageJson(['packages/*']);
+            // Both versions appear once - tie-break should prefer ^10.2.0 over ^9.5.0
+            repo.addWorkspace('@test/alpha', 'packages/alpha', { storybook: '^9.5.0' });
+            repo.addWorkspace('@test/beta', 'packages/beta', { storybook: '^10.2.0' });
+
+            const errors = await requireUnifiedDependencyVersions.fix!({ repoRoot: repo.root });
+
+            expect(errors).toEqual([]);
+
+            const alphaPkg = JSON.parse(
+                readFileSync(join(repo.root, 'packages/alpha/package.json'), 'utf-8'),
+            );
+            expect(alphaPkg.dependencies.storybook).toBe('^10.2.0');
+        });
+
+        it('fixes drift between root package.json and workspace', async () => {
+            const repo = createTempRepo();
+            // Root has one version, two workspaces have another — workspace version wins by frequency
+            repo.setRootPackageJson(['packages/*'], { lodash: '^4.17.15' });
+            repo.addWorkspace('@test/alpha', 'packages/alpha', { lodash: '^4.17.21' });
+            repo.addWorkspace('@test/beta', 'packages/beta', { lodash: '^4.17.21' });
+
+            const errors = await requireUnifiedDependencyVersions.fix!({ repoRoot: repo.root });
+
+            expect(errors).toEqual([]);
+
+            // Verify the root was updated
+            const rootPkg = JSON.parse(readFileSync(join(repo.root, 'package.json'), 'utf-8'));
+            expect(rootPkg.dependencies.lodash).toBe('^4.17.21');
+        });
+
+        it('returns no errors when there are no drifts', async () => {
+            const repo = createTempRepo();
+            repo.setRootPackageJson(['packages/*']);
+            repo.addWorkspace('@test/alpha', 'packages/alpha', { lodash: '^4.17.21' });
+            repo.addWorkspace('@test/beta', 'packages/beta', { lodash: '^4.17.21' });
+
+            const errors = await requireUnifiedDependencyVersions.fix!({ repoRoot: repo.root });
+
+            expect(errors).toEqual([]);
+        });
+    });
+});

packages/requirements/src/requirements/allRequirements.ts

@@ -1,10 +1,12 @@
 import type { Requirement, RequirementScope } from './Requirement';
 import { requireAgentsSkills } from './agents-skills/requireAgentsSkills';
+import { requireUnifiedDependencyVersions } from './dependency-versions/requireUnifiedDependencyVersions';
 import { requireDocsSummary } from './docs-summary/requireDocsSummary';
 import { requirePackageJsonScripts } from './package-json/requirePackageJsonScripts';
 
 export const requirements: ReadonlyArray<Requirement<RequirementScope>> = [
     requireAgentsSkills,
+    requireUnifiedDependencyVersions,
     requireDocsSummary,
     requirePackageJsonScripts,
 ];