Bower resolutions vs default SemVer: which yields a predictable dependency tree?

Answer

For reproducibility, an explicit resolutions block in the top‑level bower.json yields a more predictable dependency tree than relying on Bower’s default SemVer resolution. The default algorithm is only predictable when every declared range is exact (or non‑overlapping); any caret or tilde range can cause different trees across machines.

Why resolutions give predictability

Confirmed facts from Bower’s behavior:

• The default resolver picks the highest version that satisfies all declared ranges, which can vary if the set of ranges changes or if new versions are published.
• An explicit resolutions entry forces a single version for a given package name, overriding the algorithm and guaranteeing the same tree on every install, provided the pinned version satisfies each dependency’s range.
• When all top‑level dependencies use strict exact versions (e.g., "1.2.3"), the default resolver alone can be deterministic, but this is rarely the case in practice.

Steps to enforce predictability with resolutions

1. Identify every package that appears more than once in the dependency graph (use bower list or inspect bower_components).
2. For each such package, choose a version that satisfies the version ranges declared by all dependents.
3. Add a resolutions object to the top‑level bower.json, mapping package names to the chosen versions, e.g.:

   {
     "resolutions": {
       "jquery": "2.2.4",
       "lodash": "4.17.21"
     }
   }

4. Commit the updated bower.json to version control.
5. Run bower install on a clean environment and verify that the installed versions match the resolutions (e.g., ls bower_components/jquery shows the expected version).

Interaction with Git URL or local path dependencies

Git URL or local path dependencies are treated as exact versions (the resolved commit hash or filesystem snapshot). If such a dependency shares a package name with a registry package, the resolutions entry still applies and must point to a version that is compatible with the resolved commit; otherwise Bower will error. If the Git/local dependency is the only source for that package, a resolution entry is unnecessary but harmless.

Missing diagnostic detail

If you observe that a Git‑based dependency resolves to different commits on different machines, please provide the exact Git URLs and any branch/tag specifications so we can assess whether the resolution needs to be tightened.