Allow react-is ^17 as dependency

[alippai]

Now it depends on react-is ^16 which may introduce extra library for react 17 projects.
https://github.com/facebook/prop-types/blob/master/package.json#L31

[ljharb]

The problem there is that might break React 16 users - there's no way to allow v17 without auto-installing it, except by converting it to a peer dep, which would be a breaking change.

[alippai]

^16|^17 in the worst case auto installs v17, which is still better than auto installing v16. I'm not sure this is true, what do you think?

[ljharb]

In every case it will install 17, except when 16 is already present.

Using react 16 with react-is 17 is the worst possible outcome.

[ashidaharo]

It seems to me that there is one solution for now that correctly specifies the dependencies for this.
That is OptionalPeerDependencies(PeerDependencies)(Optional)
This feature allows package A to be associated with a specific version of package B, and returns an error if it tries to use package A at the same time as an unspecified version of package B is included in the dependency tree... I think. I think... if I remember correctly. If I'm not mistaken.

By bumping up the major version and specifying react ^17 as an OptionalPeerDependencies (and preferably react-is ^17 as a PeerDependencies as well), we can prevent people trying to use prop-types by specifying it as a dependency (and preferably also react-is^17 in the PeerDependencies), we can prevent people trying to use prop-types from inadvertently upgrading their version while using react ^16... should be.
If we want to continue to support react ^16, we will need to separate branches for each major version and pull the necessary bug fixes there as needed. There is currently no dependency solution to switch react-is according to the installed version of react.

... As a matter of fact, we don't know if this is really something that npm or yarn can solve correctly. Also, even if it is resolved correctly, this will confuse people who casually try to npm i prop-types@latest.
However, react has undergone a major version upgrade and breaking changes. If so, then all packages that depend on react should preferably work that way, as opposed to react-is unknowingly mixing multiple versions , or react and react-is versions not meshing.

My conclusion is that it is preferable to use PeerDependencies, because the versions of react and react-is should be the same when resolving dependencies, and there should be one of each in the whole dependency tree.
(By the way, the good old package hoist-non-react-statics still doesn't seem to support react-is ^17. Based on this theory, any package that depends on it should not be able to use it with react ^17... Funny enough, react-redux and emotion are included)

[ashidaharo]

This would be a hell of a dependency.

[ashidaharo]

...Why isn't one of react and react-is in the other's peerdependencies in the first place?

[ljharb]

They should have been (in react-is). But since they’re not, it’s too late, there’s not much to be done here. Optional peer deps would be a breaking change, because older npm versions don’t understand them.

[alippai]

Based on your answer I assume no new major version can be created. What's the reason for that?

[ashidaharo]

... History tells us that many cases similar to this have been solved by the passage of time and fashion.
Well, that is, by creating another, better solution while the old solution is out of control, tied up in history and backward compatibility.

[ashidaharo]

Well or? What if the old npm support is about to expire and the OptionalPeerDependencies become reliable?

[ljharb]

@alippai new major versions of any package should be avoided unless there's a very good reason for a breaking change.

[ashidaharo]

@alippai I agree with you that a major version release of react should be reason enough to release a major version of this package, which is downstream from react...
Well, React has an ecosystem around Typescript and Flow these days... Also, this package has a lot of commits, but no minor releases or patch releases since 2019, so you can imagine the level of attention from Facebook...

[alippai]

I don't see any issues with the reasoning above, I was just curious ¯_(ツ)_/¯