Merge pull request #3391 from backstage/rugvip/versions

cli: add versions:check and versions:bump
2020-11-23 16:23:09 +01:00
parent b80eef9a2c d20f605082
commit e906636d40
12 changed files with 1087 additions and 0 deletions
@@ -0,0 +1,5 @@
+---
+'@backstage/cli': patch
+---
+
+Add new `versions:check` and `versions:bump` commands to simplify version management and avoid conflicts
@@ -51,6 +51,7 @@
    "@types/webpack-node-externals": "^2.5.0",
    "@typescript-eslint/eslint-plugin": "^v3.10.1",
    "@typescript-eslint/parser": "^v3.10.1",
+    "@yarnpkg/lockfile": "^1.1.0",
    "bfj": "^7.0.2",
    "chalk": "^4.0.0",
    "chokidar": "^3.3.1",
@@ -92,6 +93,7 @@
    "rollup-plugin-postcss": "^3.1.1",
    "rollup-plugin-typescript2": "^0.27.3",
    "rollup-pluginutils": "^2.8.2",
+    "semver": "^7.3.2",
    "start-server-webpack-plugin": "^2.2.5",
    "style-loader": "^1.2.1",
    "sucrase": "^3.16.0",
@@ -131,6 +133,7 @@
    "@types/tar": "^4.0.3",
    "@types/webpack": "^4.41.7",
    "@types/webpack-dev-server": "^3.11.0",
+    "@types/yarnpkg__lockfile": "^1.1.4",
    "del": "^5.1.0",
    "mock-fs": "^4.13.0",
    "nodemon": "^2.0.2",
@@ -159,6 +159,17 @@ export function registerCommands(program: CommanderStatic) {
    )
    .action(lazy(() => import('./config/validate').then(m => m.default)));

+  program
+    .command('versions:bump')
+    .description('Bump Backstage packages to the latest versions')
+    .action(lazy(() => import('./versions/bump').then(m => m.default)));
+
+  program
+    .command('versions:check')
+    .option('--fix', 'Fix any auto-fixable versioning problems')
+    .description('Check Backstage package versioning')
+    .action(lazy(() => import('./versions/lint').then(m => m.default)));
+
  program
    .command('prepack')
    .description('Prepares a package for packaging before publishing')
@@ -0,0 +1,161 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import fs from 'fs-extra';
+import mockFs from 'mock-fs';
+import { resolve as resolvePath } from 'path';
+import { paths } from '../../lib/paths';
+import { mapDependencies } from '../../lib/versioning';
+import * as runObj from '../../lib/run';
+import bump from './bump';
+import { withLogCollector } from '@backstage/test-utils';
+
+const REGISTRY_VERSIONS: { [name: string]: string } = {
+  '@backstage/core': '1.0.7',
+  '@backstage/theme': '2.0.0',
+};
+
+const HEADER = `# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+`;
+
+const lockfileMock = `${HEADER}
+"@backstage/core@^1.0.5":
+  version "1.0.6"
+  resolved "https://my-registry/a-1.0.01.tgz#abc123"
+  integrity sha512-xyz
+
+"@backstage/core@^1.0.3":
+  version "1.0.3"
+  resolved "https://my-registry/a-1.0.01.tgz#abc123"
+  integrity sha512-xyz
+
+"@backstage/theme@^1.0.0":
+  version "1.0.0"
+  resolved "https://my-registry/a-1.0.01.tgz#abc123"
+  integrity sha512-xyz
+`;
+
+const lockfileMockResult = `${HEADER}
+"@backstage/core@^1.0.3", "@backstage/core@^1.0.5":
+  version "1.0.6"
+  resolved "https://my-registry/a-1.0.01.tgz#abc123"
+  integrity sha512-xyz
+
+"@backstage/theme@^1.0.0":
+  version "1.0.0"
+  resolved "https://my-registry/a-1.0.01.tgz#abc123"
+  integrity sha512-xyz
+`;
+
+describe('bump', () => {
+  afterEach(() => {
+    mockFs.restore();
+    jest.resetAllMocks();
+  });
+
+  it('should bump backstage dependencies', async () => {
+    // Make sure all modules involved in package discovery are in the module cache before we mock fs
+    await mapDependencies(paths.targetDir);
+
+    mockFs({
+      '/yarn.lock': lockfileMock,
+      '/lerna.json': JSON.stringify({
+        packages: ['packages/*'],
+      }),
+      '/packages/a/package.json': JSON.stringify({
+        name: 'a',
+        dependencies: {
+          '@backstage/core': '^1.0.5',
+        },
+      }),
+      '/packages/b/package.json': JSON.stringify({
+        name: 'b',
+        dependencies: {
+          '@backstage/core': '^1.0.3',
+          '@backstage/theme': '^1.0.0',
+        },
+      }),
+    });
+
+    paths.targetDir = '/';
+    jest
+      .spyOn(paths, 'resolveTargetRoot')
+      .mockImplementation((...paths) => resolvePath('/', ...paths));
+    jest.spyOn(runObj, 'runPlain').mockImplementation(async (...[, , , name]) =>
+      JSON.stringify({
+        type: 'inspect',
+        data: {
+          name: name,
+          'dist-tags': {
+            latest: REGISTRY_VERSIONS[name],
+          },
+        },
+      }),
+    );
+    jest.spyOn(runObj, 'run').mockResolvedValue(undefined);
+
+    const { log: logs } = await withLogCollector(['log'], async () => {
+      await bump();
+    });
+    expect(logs.filter(Boolean)).toEqual([
+      'Checking for updates of @backstage/theme',
+      'Checking for updates of @backstage/core',
+      'Some packages are outdated, updating',
+      'Bumping @backstage/theme in b to ^2.0.0',
+      "Running 'yarn install' to install new versions",
+      'Removing duplicate dependencies from yarn.lock',
+      "Running 'yarn install' to remove duplicates from node_modules",
+    ]);
+
+    expect(runObj.runPlain).toHaveBeenCalledTimes(2);
+    expect(runObj.runPlain).toHaveBeenCalledWith(
+      'yarn',
+      'info',
+      '--json',
+      '@backstage/core',
+    );
+    expect(runObj.runPlain).toHaveBeenCalledWith(
+      'yarn',
+      'info',
+      '--json',
+      '@backstage/theme',
+    );
+
+    expect(runObj.run).toHaveBeenCalledTimes(2);
+    expect(runObj.run).toHaveBeenCalledWith('yarn', ['install']);
+
+    const lockfileContents = await fs.readFile('/yarn.lock', 'utf8');
+    expect(lockfileContents).toBe(lockfileMockResult);
+
+    const packageA = await fs.readJson('/packages/a/package.json');
+    expect(packageA).toEqual({
+      name: 'a',
+      dependencies: {
+        '@backstage/core': '^1.0.5', // not bumped since new version is within range
+      },
+    });
+    const packageB = await fs.readJson('/packages/b/package.json');
+    expect(packageB).toEqual({
+      name: 'b',
+      dependencies: {
+        '@backstage/core': '^1.0.3', // not bumped
+        '@backstage/theme': '^2.0.0', // bumped since newer
+      },
+    });
+  });
+});
@@ -0,0 +1,162 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import fs from 'fs-extra';
+import semver from 'semver';
+import { resolve as resolvePath } from 'path';
+import { run } from '../../lib/run';
+import { paths } from '../../lib/paths';
+import {
+  mapDependencies,
+  fetchPackageInfo,
+  Lockfile,
+} from '../../lib/versioning';
+
+const DEP_TYPES = [
+  'dependencies',
+  'devDependencies',
+  'peerDependencies',
+  'optionalDependencies',
+];
+
+type PkgVersionInfo = {
+  range: string;
+  name: string;
+  location: string;
+};
+
+export default async () => {
+  // First we discover all Backstage dependencies within our own repo
+  const dependencyMap = await mapDependencies(paths.targetDir);
+
+  // Next check with the package registry what the latest version of all of those dependencies are
+  const targetVersions = new Map<string, string>();
+  await workerThreads(16, dependencyMap.keys(), async name => {
+    console.log(`Checking for updates of ${name}`);
+    const info = await fetchPackageInfo(name);
+    const latest = info['dist-tags'].latest;
+    if (!latest) {
+      throw new Error(`No latest version found for ${name}`);
+    }
+
+    targetVersions.set(name, latest);
+  });
+
+  // Then figure out which local packages need to have their dependencies bumped
+  const versionBumps = new Map<string, PkgVersionInfo[]>();
+  for (const [name, pkgs] of dependencyMap) {
+    const targetVersion = targetVersions.get(name)!;
+    for (const pkg of pkgs) {
+      if (semver.satisfies(targetVersion, pkg.range)) {
+        continue;
+      }
+
+      versionBumps.set(
+        pkg.name,
+        (versionBumps.get(pkg.name) ?? []).concat({
+          name,
+          location: pkg.location,
+          range: `^${targetVersion}`, // TODO(Rugvip): Option to use something else than ^?
+        }),
+      );
+    }
+  }
+
+  console.log();
+
+  // Write all discovered version bumps to package.json in this repo
+  if (versionBumps.size === 0) {
+    console.log('All Backstage packages are up to date!');
+  } else {
+    console.log('Some packages are outdated, updating');
+    console.log();
+
+    await workerThreads(16, versionBumps.entries(), async ([name, deps]) => {
+      const pkgPath = resolvePath(deps[0].location, 'package.json');
+      const pkgJson = await fs.readJson(pkgPath);
+
+      for (const dep of deps) {
+        console.log(`Bumping ${dep.name} in ${name} to ${dep.range}`);
+
+        for (const depType of DEP_TYPES) {
+          if (depType in pkgJson && dep.name in pkgJson[depType]) {
+            pkgJson[depType][dep.name] = dep.range;
+          }
+        }
+      }
+
+      await fs.writeJson(pkgPath, pkgJson, { spaces: 2 });
+    });
+
+    console.log();
+    console.log("Running 'yarn install' to install new versions");
+    console.log();
+    await run('yarn', ['install']);
+  }
+
+  console.log();
+
+  // Finally we make sure the new lockfile doesn't have any duplicates
+  const lockfile = await Lockfile.load(paths.resolveTargetRoot('yarn.lock'));
+  const result = lockfile.analyze({
+    filter: name => dependencyMap.has(name),
+  });
+
+  if (result.newVersions.length > 0) {
+    console.log();
+    console.log('Removing duplicate dependencies from yarn.lock');
+    lockfile.replaceVersions(result.newVersions);
+    await lockfile.save();
+
+    console.log(
+      "Running 'yarn install' to remove duplicates from node_modules",
+    );
+    console.log();
+    await run('yarn', ['install']);
+
+    console.log();
+  }
+
+  if (result.newRanges.length > 0) {
+    throw new Error(
+      `Version bump failed for ${result.newRanges.map(i => i.name).join(', ')}`,
+    );
+  }
+};
+
+async function workerThreads<T>(
+  count: number,
+  items: IterableIterator<T>,
+  fn: (item: T) => Promise<void>,
+) {
+  const queue = Array.from(items);
+
+  async function pop() {
+    const item = queue.pop();
+    if (!item) {
+      return;
+    }
+
+    await fn(item);
+    await pop();
+  }
+
+  return Promise.all(
+    Array(count)
+      .fill(0)
+      .map(() => pop()),
+  );
+}
@@ -0,0 +1,111 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { Command } from 'commander';
+import { Lockfile } from '../../lib/versioning';
+import { paths } from '../../lib/paths';
+import partition from 'lodash/partition';
+
+// Packages that we try to avoid duplicates for
+const INCLUDED = [/^@backstage\//];
+
+// Packages that are not allowed to have any duplicates
+const FORBID_DUPLICATES = [
+  /^@backstage\/core$/,
+  /^@backstage\/core-api$/,
+  /^@backstage\/plugin-/,
+];
+
+export default async (cmd: Command) => {
+  const fix = Boolean(cmd.fix);
+
+  let success = true;
+
+  const lockfile = await Lockfile.load(paths.resolveTargetRoot('yarn.lock'));
+  const result = lockfile.analyze({
+    filter: name => INCLUDED.some(pattern => pattern.test(name)),
+  });
+
+  logArray(
+    result.invalidRanges,
+    "The following packages versions are invalid and can't be analyzed:",
+    e => `  ${e.name} @ ${e.range}`,
+  );
+
+  if (fix) {
+    lockfile.replaceVersions(result.newVersions);
+    await lockfile.save();
+  } else {
+    const [
+      newVersionsForbidden,
+      newVersionsAllowed,
+    ] = partition(result.newVersions, ({ name }) =>
+      FORBID_DUPLICATES.some(pattern => pattern.test(name)),
+    );
+    if (newVersionsForbidden.length && !fix) {
+      success = false;
+    }
+
+    logArray(
+      newVersionsForbidden,
+      'The following packages must be deduplicated, this can be done automatically with --fix',
+      e =>
+        `  ${e.name} @ ${e.range} bumped from ${e.oldVersion} to ${e.newVersion}`,
+    );
+    logArray(
+      newVersionsAllowed,
+      'The following packages can be deduplicated, this can be done automatically with --fix',
+      e =>
+        `  ${e.name} @ ${e.range} bumped from ${e.oldVersion} to ${e.newVersion}`,
+    );
+  }
+
+  const [newRangesForbidden, newRangesAllowed] = partition(
+    result.newRanges,
+    ({ name }) => FORBID_DUPLICATES.some(pattern => pattern.test(name)),
+  );
+  if (newRangesForbidden.length) {
+    success = false;
+  }
+
+  logArray(
+    newRangesForbidden,
+    'The following packages must be deduplicated by updating dependencies in package.json',
+    e => `  ${e.name} @ ${e.oldRange} should be changed to ${e.newRange}`,
+  );
+  logArray(
+    newRangesAllowed,
+    'The following packages can be deduplicated by updating dependencies in package.json',
+    e => `  ${e.name} @ ${e.oldRange} should be changed to ${e.newRange}`,
+  );
+
+  if (!success) {
+    throw new Error('Failed versioning check');
+  }
+};
+
+function logArray<T>(arr: T[], header: string, each: (item: T) => string) {
+  if (arr.length === 0) {
+    return;
+  }
+
+  console.log(header);
+  console.log();
+  for (const e of arr) {
+    console.log(each(e));
+  }
+  console.log();
+}
@@ -0,0 +1,155 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import fs from 'fs-extra';
+import mockFs from 'mock-fs';
+import { Lockfile } from './Lockfile';
+
+const HEADER = `# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+`;
+
+const mockA = `${HEADER}
+a@^1:
+  version "1.0.1"
+  resolved "https://my-registry/a-1.0.01.tgz#abc123"
+  integrity sha512-xyz
+  dependencies:
+    b "^2"
+
+b@2.0.x:
+  version "2.0.1"
+
+b@^2:
+  version "2.0.0"
+`;
+
+const mockADedup = `${HEADER}
+a@^1:
+  version "1.0.1"
+  resolved "https://my-registry/a-1.0.01.tgz#abc123"
+  integrity sha512-xyz
+  dependencies:
+    b "^2"
+
+b@2.0.x, b@^2:
+  version "2.0.1"
+`;
+
+const mockB = `${HEADER}
+"@s/a@*", "@s/a@1 || 2", "@s/a@^1":
+  version "1.0.1"
+
+"@s/a@^2.0.x":
+  version "2.0.0"
+`;
+
+const mockBDedup = `${HEADER}
+"@s/a@*", "@s/a@1 || 2", "@s/a@^2.0.x":
+  version "2.0.0"
+
+"@s/a@^1":
+  version "1.0.1"
+`;
+
+describe('Lockfile', () => {
+  afterEach(() => {
+    mockFs.restore();
+  });
+
+  it('should load and serialize mockA', async () => {
+    mockFs({
+      '/yarn.lock': mockA,
+    });
+
+    const lockfile = await Lockfile.load('/yarn.lock');
+    expect(lockfile.get('a')).toEqual([{ range: '^1', version: '1.0.1' }]);
+    expect(lockfile.get('b')).toEqual([
+      { range: '2.0.x', version: '2.0.1' },
+      { range: '^2', version: '2.0.0' },
+    ]);
+    expect(lockfile.toString()).toBe(mockA);
+  });
+
+  it('should deduplicate and save mockA', async () => {
+    mockFs({
+      '/yarn.lock': mockA,
+    });
+
+    const lockfile = await Lockfile.load('/yarn.lock');
+    const result = lockfile.analyze();
+    expect(result).toEqual({
+      invalidRanges: [],
+      newRanges: [],
+      newVersions: [
+        {
+          name: 'b',
+          range: '^2',
+          oldVersion: '2.0.0',
+          newVersion: '2.0.1',
+        },
+      ],
+    });
+
+    expect(lockfile.toString()).toBe(mockA);
+    lockfile.replaceVersions(result.newVersions);
+    expect(lockfile.toString()).toBe(mockADedup);
+
+    await expect(fs.readFile('/yarn.lock', 'utf8')).resolves.toBe(mockA);
+    await expect(lockfile.save()).resolves.toBeUndefined();
+    await expect(fs.readFile('/yarn.lock', 'utf8')).resolves.toBe(mockADedup);
+  });
+
+  it('should deduplicate mockB', async () => {
+    mockFs({
+      '/yarn.lock': mockB,
+    });
+
+    const lockfile = await Lockfile.load('/yarn.lock');
+    const result = lockfile.analyze();
+    expect(result).toEqual({
+      invalidRanges: [],
+      newRanges: [
+        {
+          name: '@s/a',
+          oldRange: '^1',
+          newRange: '^2.0.x',
+          oldVersion: '1.0.1',
+          newVersion: '2.0.0',
+        },
+      ],
+      newVersions: [
+        {
+          name: '@s/a',
+          range: '*',
+          oldVersion: '1.0.1',
+          newVersion: '2.0.0',
+        },
+        {
+          name: '@s/a',
+          range: '1 || 2',
+          oldVersion: '1.0.1',
+          newVersion: '2.0.0',
+        },
+      ],
+    });
+
+    expect(lockfile.toString()).toBe(mockB);
+    lockfile.replaceVersions(result.newVersions);
+    expect(lockfile.toString()).toBe(mockBDedup);
+  });
+});
@@ -0,0 +1,253 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import fs from 'fs-extra';
+import semver from 'semver';
+import {
+  parse as parseLockfile,
+  stringify as stringifyLockfile,
+} from '@yarnpkg/lockfile';
+
+const ENTRY_PATTERN = /^((?:@[^/]+\/)?[^@/]+)@(.+)$/;
+
+type LockfileData = {
+  [entry: string]: {
+    version: string;
+    resolved?: string;
+    integrity?: string;
+    dependencies?: { [name: string]: string };
+  };
+};
+
+type LockfileQueryEntry = {
+  range: string;
+  version: string;
+};
+
+/** Entries that have an invalid version range, for example an NPM tag */
+type AnalyzeResultInvalidRange = {
+  name: string;
+  range: string;
+};
+
+/** Entries that can be deduplicated by bumping to an existing higher version */
+type AnalyzeResultNewVersion = {
+  name: string;
+  range: string;
+  oldVersion: string;
+  newVersion: string;
+};
+
+/** Entries that would need a dependency update in package.json to be deduplicated */
+type AnalyzeResultNewRange = {
+  name: string;
+  oldRange: string;
+  newRange: string;
+  oldVersion: string;
+  newVersion: string;
+};
+
+type AnalyzeResult = {
+  invalidRanges: AnalyzeResultInvalidRange[];
+  newVersions: AnalyzeResultNewVersion[];
+  newRanges: AnalyzeResultNewRange[];
+};
+
+export class Lockfile {
+  static async load(path: string) {
+    const lockfileContents = await fs.readFile(path, 'utf8');
+    const lockfile = parseLockfile(lockfileContents);
+    if (lockfile.type !== 'success') {
+      throw new Error(`Failed yarn.lock parse with ${lockfile.type}`);
+    }
+
+    const data = lockfile.object as LockfileData;
+    const packages = new Map<string, LockfileQueryEntry[]>();
+
+    for (const [key, value] of Object.entries(data)) {
+      const [, name, range] = ENTRY_PATTERN.exec(key) ?? [];
+      if (!name) {
+        throw new Error(`Failed to parse yarn.lock entry '${key}'`);
+      }
+
+      let queries = packages.get(name);
+      if (!queries) {
+        queries = [];
+        packages.set(name, queries);
+      }
+      queries.push({ range, version: value.version });
+    }
+
+    return new Lockfile(path, packages, data);
+  }
+
+  private constructor(
+    private readonly path: string,
+    private readonly packages: Map<string, LockfileQueryEntry[]>,
+    private readonly data: LockfileData,
+  ) {}
+
+  get(name: string): LockfileQueryEntry[] | undefined {
+    return this.packages.get(name);
+  }
+
+  /** Analyzes the lockfile to identify possible actions and warnings for the entries */
+  analyze(options?: { filter?: (name: string) => boolean }): AnalyzeResult {
+    const { filter } = options ?? {};
+    const result: AnalyzeResult = {
+      invalidRanges: [],
+      newVersions: [],
+      newRanges: [],
+    };
+
+    for (const [name, allEntries] of this.packages) {
+      if (filter && !filter(name)) {
+        continue;
+      }
+
+      // Get rid of and signal any invalid ranges upfront
+      const invalid = allEntries.filter(e => !semver.validRange(e.range));
+      result.invalidRanges.push(
+        ...invalid.map(({ range }) => ({ name, range })),
+      );
+
+      // Grab all valid entries, if there aren't at least 2 different valid ones we're done
+      const entries = allEntries.filter(e => semver.validRange(e.range));
+      if (entries.length < 2) {
+        continue;
+      }
+
+      // Find all versions currently in use
+      const versions = Array.from(
+        new Set(entries.map(e => e.version)),
+      ).sort((v1, v2) => semver.rcompare(v1, v2));
+
+      // If we're not using at least 2 different versions we're done
+      if (versions.length < 2) {
+        continue;
+      }
+
+      const acceptedVersions = new Set<string>();
+      for (const { version, range } of entries) {
+        // Finds the highest matching version from the the known versions
+        // TODO(Rugvip): We may want to select the version that satisfies the most ranges rather than the highest one
+        const acceptedVersion = versions.find(v => semver.satisfies(v, range));
+        if (!acceptedVersion) {
+          throw new Error(
+            `No existing version was accepted for range ${range}, searching through ${versions}`,
+          );
+        }
+
+        if (acceptedVersion !== version) {
+          result.newVersions.push({
+            name,
+            range,
+            newVersion: acceptedVersion,
+            oldVersion: version,
+          });
+        }
+
+        acceptedVersions.add(acceptedVersion);
+      }
+
+      // If all ranges were able to accept the same version, we're done
+      if (acceptedVersions.size === 1) {
+        continue;
+      }
+
+      // Find the max version that we may want bump older packages to
+      const maxVersion = Array.from(acceptedVersions).sort(semver.rcompare)[0];
+      // Find all existing ranges that satisfy the new max version, and pick the one that
+      // results in the highest minimum allowed version, usually being the more specific one
+      const maxEntry = entries
+        .filter(e => semver.satisfies(maxVersion, e.range))
+        .map(e => ({ e, min: semver.minVersion(e.range) }))
+        .filter(p => p.min)
+        .sort((a, b) => semver.rcompare(a.min!, b.min!))[0]?.e;
+      if (!maxEntry) {
+        throw new Error(
+          `No entry found that satisfies max version '${maxVersion}'`,
+        );
+      }
+
+      // Find all entries that don't satisfy the max version
+      for (const { version, range } of entries) {
+        if (semver.satisfies(maxVersion, range)) {
+          continue;
+        }
+
+        result.newRanges.push({
+          name,
+          oldRange: range,
+          newRange: maxEntry.range,
+          oldVersion: version,
+          newVersion: maxVersion,
+        });
+      }
+    }
+
+    return result;
+  }
+
+  /** Modifies the lockfile by bumping packages to the suggested versions */
+  replaceVersions(results: AnalyzeResultNewVersion[]) {
+    for (const { name, range, oldVersion, newVersion } of results) {
+      const query = `${name}@${range}`;
+
+      // Update the backing data
+      const entryData = this.data[query];
+      if (!entryData) {
+        throw new Error(`No entry data for ${query}`);
+      }
+      if (entryData.version !== oldVersion) {
+        throw new Error(
+          `Expected existing version data for ${query} to be ${oldVersion}, was ${entryData.version}`,
+        );
+      }
+
+      // Modifying the data in the entry is not enough, we need to reference an existing version object
+      const matchingEntry = Object.entries(this.data).find(
+        ([q, e]) => q.startsWith(`${name}@`) && e.version === newVersion,
+      );
+      if (!matchingEntry) {
+        throw new Error(
+          `No matching entry found for ${name} at version ${newVersion}`,
+        );
+      }
+      this.data[query] = matchingEntry[1];
+
+      // Update our internal data structure
+      const entry = this.packages.get(name)?.find(e => e.range === range);
+      if (!entry) {
+        throw new Error(`No entry data for ${query}`);
+      }
+      if (entry.version !== oldVersion) {
+        throw new Error(
+          `Expected existing version data for ${query} to be ${oldVersion}, was ${entryData.version}`,
+        );
+      }
+      entry.version = newVersion;
+    }
+  }
+
+  async save() {
+    await fs.writeFile(this.path, this.toString(), 'utf8');
+  }
+
+  toString() {
+    return stringifyLockfile(this.data);
+  }
+}
@@ -0,0 +1,18 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { Lockfile } from './Lockfile';
+export { fetchPackageInfo, mapDependencies } from './packages';
@@ -0,0 +1,109 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import mockFs from 'mock-fs';
+import * as runObj from '../run';
+import { paths } from '../paths';
+import { fetchPackageInfo, mapDependencies } from './packages';
+
+describe('fetchPackageInfo', () => {
+  afterEach(() => {
+    jest.resetAllMocks();
+  });
+
+  it('should forward info', async () => {
+    jest
+      .spyOn(runObj, 'runPlain')
+      .mockResolvedValue(`{"type":"inspect","data":{"the":"data"}}`);
+
+    await expect(fetchPackageInfo('my-package')).resolves.toEqual({
+      the: 'data',
+    });
+    expect(runObj.runPlain).toHaveBeenCalledWith(
+      'yarn',
+      'info',
+      '--json',
+      'my-package',
+    );
+  });
+});
+
+describe('mapDependencies', () => {
+  afterEach(() => {
+    mockFs.restore();
+    jest.resetAllMocks();
+  });
+
+  it('should read dependencies', async () => {
+    // Make sure all modules involved in package discovery are in the module cache before we mock fs
+    const LernaProject = require('@lerna/project');
+    const project = new LernaProject(paths.targetDir);
+    await project.getPackages();
+
+    mockFs({
+      '/lerna.json': JSON.stringify({
+        packages: ['pkgs/*'],
+      }),
+      '/pkgs/a/package.json': JSON.stringify({
+        name: 'a',
+        dependencies: {
+          '@backstage/core': '1 || 2',
+        },
+      }),
+      '/pkgs/b/package.json': JSON.stringify({
+        name: 'b',
+        dependencies: {
+          '@backstage/core': '3',
+          '@backstage/cli': '^0',
+        },
+      }),
+    });
+
+    const oldDir = paths.targetDir;
+    paths.targetDir = '/';
+
+    const dependencyMap = await mapDependencies(paths.targetDir);
+    expect(Array.from(dependencyMap)).toEqual([
+      [
+        '@backstage/core',
+        [
+          {
+            name: 'a',
+            range: '1 || 2',
+            location: '/pkgs/a',
+          },
+          {
+            name: 'b',
+            range: '3',
+            location: '/pkgs/b',
+          },
+        ],
+      ],
+      [
+        '@backstage/cli',
+        [
+          {
+            name: 'b',
+            range: '^0',
+            location: '/pkgs/b',
+          },
+        ],
+      ],
+    ]);
+
+    paths.targetDir = oldDir;
+  });
+});
@@ -0,0 +1,89 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { runPlain } from '../../lib/run';
+
+const PREFIX = '@backstage';
+
+const DEP_TYPES = [
+  'dependencies',
+  'devDependencies',
+  'peerDependencies',
+  'optionalDependencies',
+];
+
+// Package data as returned by `yarn info`
+type YarnInfoInspectData = {
+  name: string;
+  'dist-tags': { latest: string };
+  versions: string[];
+  time: { [version: string]: string };
+};
+
+// Possible `yarn info` output
+type YarnInfo = {
+  type: 'inspect';
+  data: YarnInfoInspectData | { type: string; data: unknown };
+};
+
+type PkgVersionInfo = {
+  range: string;
+  name: string;
+  location: string;
+};
+
+export async function fetchPackageInfo(
+  name: string,
+): Promise<YarnInfoInspectData> {
+  const output = await runPlain('yarn', 'info', '--json', name);
+  const info = JSON.parse(output) as YarnInfo;
+  if (info.type !== 'inspect') {
+    throw new Error(`Received unknown yarn info for ${name}, ${output}`);
+  }
+
+  return info.data as YarnInfoInspectData;
+}
+
+/** Map all dependencies in the repo as dependency => dependents */
+export async function mapDependencies(
+  targetDir: string,
+): Promise<Map<string, PkgVersionInfo[]>> {
+  const LernaProject = require('@lerna/project');
+  const project = new LernaProject(targetDir);
+  const packages = await project.getPackages();
+
+  const dependencyMap = new Map<string, PkgVersionInfo[]>();
+  for (const pkg of packages) {
+    const deps = DEP_TYPES.flatMap(
+      t => Object.entries(pkg.get(t) ?? {}) as [string, string][],
+    );
+
+    for (const [name, range] of deps) {
+      if (name.startsWith(PREFIX)) {
+        dependencyMap.set(
+          name,
+          (dependencyMap.get(name) ?? []).concat({
+            range,
+            name: pkg.name,
+            location: pkg.location,
+          }),
+        );
+      }
+    }
+  }
+
+  return dependencyMap;
+}
@@ -6109,6 +6109,11 @@
  dependencies:
    "@types/yargs-parser" "*"

+"@types/yarnpkg__lockfile@^1.1.4":
+  version "1.1.4"
+  resolved "https://registry.npmjs.org/@types/yarnpkg__lockfile/-/yarnpkg__lockfile-1.1.4.tgz#445251eb00bd9c1e751f82c7c6bf4f714edfd464"
+  integrity sha512-/emrKCfQMQmFCqRqqBJ0JueHBT06jBRM3e8OgnvDUcvuExONujIk2hFA5dNsN9Nt41ljGVDdChvCydATZ+KOZw==
+
 "@types/yup@^0.29.8":
  version "0.29.8"
  resolved "https://registry.npmjs.org/@types/yup/-/yup-0.29.8.tgz#83db15735987db9fe5a38772a0fb9500e3c5bf39"
@@ -6405,6 +6410,11 @@
  resolved "https://registry.npmjs.org/@xtuc/long/-/long-4.2.2.tgz#d291c6a4e97989b5c61d9acf396ae4fe133a718d"
  integrity sha512-NuHqBY1PB/D8xU6s/thBgOAiAP7HOYDQ32+BFZILJ8ivkUkAHQnWfn6WhL79Owj1qmUnoN/YPhktdIoucipkAQ==

+"@yarnpkg/lockfile@^1.1.0":
+  version "1.1.0"
+  resolved "https://registry.npmjs.org/@yarnpkg/lockfile/-/lockfile-1.1.0.tgz#e77a97fbd345b76d83245edcd17d393b1b41fb31"
+  integrity sha512-GpSwvyXOcOOlV70vbnzjj4fW5xW/FdUF6nQEt1ENy7m4ZCczi1+/buVUPAqmGfqznsORNFzUMjctTIp8a9tuCQ==
+
 "@zkochan/cmd-shim@^3.1.0":
  version "3.1.0"
  resolved "https://registry.npmjs.org/@zkochan/cmd-shim/-/cmd-shim-3.1.0.tgz#2ab8ed81f5bb5452a85f25758eb9b8681982fd2e"