fix(gatsby-source-graphql): support yarn 2

[kevin940726]

Description

In order to support yarn 2 (berry, PnP). We have to list graphql as dependency in gatsby-source-graphql. The approach I take here is to simply list it as dependency rather than using createRequire as seen in #20638 due to the suggestions #20638 (review) and yarnpkg/berry#689 (comment). It should also be compatible to npm or yarn 1. I've tested it with the reproduction repo created by @esphen.

Related Issues

Addresses #20949 (comment)

[pieh]

The graphql package is very tricky, because if there are multiple graphql packages you will get "Ensure that there are not multiple versions of GraphQL installed in your node_modules directory" errors - see graphql/graphql-js#594 - you can also try googling for this exact error and will see bunch of issues on different repos, stack overflow questions and medium posts.

I'm not sure, but this approach can produce errors like this in some cases, depending on how package manager will construct node_modules directory tree (as in - this can affect non PnP case and trade one problem for another)

[kevin940726]

Tagging @arcanis and @larixer here following the discussion we had on discord.

Basically the problem now looks something like this

project-root
├─ gatsby
│  └─ graphql
└─ gatsby-source-graphql
   └─ apollo-link (needs graphql as peer dependency)
      └─ apollo-utilities (also needs graphql as peer dependency)

Since gatsby-source-graphql itself doesn't call graphql directly, but apollo-link and apollo-utilities do, we can't use the createRequire trick here.
We also can't list graphql as direct dependency here because of the above reason.

A suggestion made by @larixer is to list graphql as peer dependency of gatsby. Since it's served as a singleton package, just like react and react-dom, it makes sense for it to be treated like them too. However, it would probably break existing behavior and require a major version bump.

Another potential solution made by @arcanis suggest that we list graphql both as a peer dependency and as a regular dependency. Yarn 2 will make sure to use the regular dependency listed by gatsby as a fallback when the user didn't provide one. However, we still need to investigate whether it breaks yarn 1 or npm.

For this particular case though, both apollo-link and apollo-utilities use only the modules in graphql/language, which don't suffer from the singleton requirement of the graphql runtime. I think we can safely list graphql as dependency for gatsby-source-graphql here. Yet, we can't be sure that it won't require the graphql runtime some day, the solution is temporary.

Got any other ideas? Maybe something related to resolutions field or plugin-compat? Am I missing something obvious here? 🤔

[eliihen]

Would making gatsby-source-graphql depend on graphql@* solve the issue by making the dependency resolution mechanism resolve both versions to the same version as the user has in their package.json? Just throwing it out there, haven't tried it yet

[kevin940726]

@esphen Interesting. But I think it's essentially the same as listing the version equal to the one in gatsby dependencies?

I feel like eventually we can break down to when or how duplicate packages would happen. If it's unlikely to happen in this context then we can safely ignore it?

[pieh]

But I think it's essentially the same as listing the version equal to the one in gatsby dependencies?

But one in gatsby changes periodically (when we bump deps), so it would be tricky to try to keep same version in core as in this plugin. And because user can have mismatched core and plugin versions those might drift and resolve to different instances of graphql package.

I'm not sure if using wildcard version selector (*) could also result in multi graphql instances in some cases - question here if lock files would try to pin that dep that first installed version or it would adjust to version of graphql package specified by gatsby core. It definitely sounds intriguing

[vladar]

@pieh gatsby-source-graphql now actually uses tools from graphql package and so it is required as a dependency.

gatsby/packages/gatsby-source-graphql/package.json

Line 14 in 8a82187

"graphql": "^14.6.0",

I guess we'll have to keep an eye on it and make sure graphql version of gatsby-source-graphql and gatsby stay in sync.

So this PR is no longer needed as it's already a dependency. Thanks for taking your time and opening this 👍