@teambit/dependencies 1.0.1233 → 1.0.1235

package/dependencies-loader/apply-overrides.spec.ts

@@ -0,0 +1,85 @@
+import { expect } from 'chai';
+import { ComponentID } from '@teambit/component-id';
+import { Dependency } from '@teambit/legacy.consumer-component';
+import { ComponentOverrides } from '@teambit/legacy.consumer-config';
+import type { DependencyResolverMain } from '@teambit/dependency-resolver';
+import type { Logger } from '@teambit/logger';
+import { ApplyOverrides } from './apply-overrides';
+
+const noopLogger = { debug() {}, warn() {}, trace() {} } as unknown as Logger;
+
+function createApplyOverrides(forcedDeps: Record<string, Record<string, string>>) {
+  const id = ComponentID.fromString('my-scope/my-env@0.0.1');
+  const component = { id, componentId: id, issues: undefined, overrides: new ComponentOverrides(forcedDeps) };
+  // no workspace, as in a bare scope
+  return new ApplyOverrides(component as any, {} as DependencyResolverMain, noopLogger);
+}
+
+describe('ApplyOverrides', () => {
+  describe('outside a workspace, a forced dependency that is a component dependency in another field', () => {
+    // e.g. a peer that an env sets for itself (in env.jsonc) is a runtime dependency of the env. the env of the env
+    // may set it as a peer, which moves the component dependency to the peers before the forced deps are added.
+    const peerDep = new Dependency(
+      ComponentID.fromString('my-scope/ui/button@1.0.0'),
+      [],
+      '@my-scope/ui.button',
+      '^1.0.0'
+    );
+    let result: ReturnType<ApplyOverrides['getDependenciesToAddManually']>;
+    before(() => {
+      const applyOverrides = createApplyOverrides({ dependencies: { '@my-scope/ui.button': '1.0.0' } });
+      applyOverrides.allDependencies = { dependencies: [], devDependencies: [], peerDependencies: [peerDep] };
+      result = applyOverrides.getDependenciesToAddManually(undefined, applyOverrides.allDependencies);
+    });
+    it('should resolve the package to the component, as the node_modules of a workspace would', () => {
+      expect(result?.components.dependencies).to.have.lengthOf(1);
+      expect(result?.components.dependencies[0].componentId.toString()).to.equal('my-scope/ui/button@1.0.0');
+      expect(result?.packages).to.deep.equal({});
+    });
+    it('should not set a version range on a runtime component dependency', () => {
+      expect(result?.components.dependencies[0].versionRange).to.be.undefined;
+    });
+  });
+});
+
+function createApplyOverridesWithPolicy({
+  installed,
+  inWorkspacePolicy,
+}: {
+  installed?: string;
+  inWorkspacePolicy?: string;
+}) {
+  const applyOverrides = Object.create(ApplyOverrides.prototype);
+  applyOverrides.depsResolver = {
+    getWorkspacePolicyManifest: () => ({ dependencies: inWorkspacePolicy ? { 'my-pkg': inWorkspacePolicy } : {} }),
+  };
+  applyOverrides._resolvePackageData = () => (installed ? { concreteVersion: installed } : undefined);
+  return applyOverrides;
+}
+
+describe('ApplyOverrides.resolveEnvPeerDepVersion()', () => {
+  it('should prefer the installed version by default', () => {
+    const applyOverrides = createApplyOverridesWithPolicy({ installed: '2.0.0', inWorkspacePolicy: '3.0.1' });
+    expect(applyOverrides.resolveEnvPeerDepVersion('my-pkg')).to.equal('2.0.0');
+  });
+  it('should prefer the workspace policy when asked to, as the installed version could be outdated', () => {
+    const applyOverrides = createApplyOverridesWithPolicy({ installed: '2.0.0', inWorkspacePolicy: '3.0.1' });
+    expect(applyOverrides.resolveEnvPeerDepVersion('my-pkg', true)).to.equal('3.0.1');
+  });
+  it('should prefer the installed version when it satisfies the workspace policy range', () => {
+    const applyOverrides = createApplyOverridesWithPolicy({ installed: '18.2.0', inWorkspacePolicy: '^18.0.0' });
+    expect(applyOverrides.resolveEnvPeerDepVersion('my-pkg', true)).to.equal('18.2.0');
+  });
+  it('should take the minimum version of the workspace policy range when the installed one is outdated', () => {
+    const applyOverrides = createApplyOverridesWithPolicy({ installed: '17.0.0', inWorkspacePolicy: '^18.1.0' });
+    expect(applyOverrides.resolveEnvPeerDepVersion('my-pkg', true)).to.equal('18.1.0');
+  });
+  it('should keep an unconstrained workspace policy range as is', () => {
+    const applyOverrides = createApplyOverridesWithPolicy({ inWorkspacePolicy: '*' });
+    expect(applyOverrides.resolveEnvPeerDepVersion('my-pkg', true)).to.equal('*');
+  });
+  it('should fall back to the installed version when the workspace policy does not have the package', () => {
+    const applyOverrides = createApplyOverridesWithPolicy({ installed: '2.0.0' });
+    expect(applyOverrides.resolveEnvPeerDepVersion('my-pkg', true)).to.equal('2.0.0');
+  });
+});

package/dependencies-loader/apply-overrides.ts

@@ -1,4 +1,5 @@
 import path from 'path';
+import semver from 'semver';
 import type { ComponentID } from '@teambit/component-id';
 import { ComponentIdList } from '@teambit/component-id';
 import { cloneDeep, difference, forEach, isEmpty, pick, pickBy, uniq } from 'lodash';
@@ -14,6 +15,7 @@ import type { ResolvedPackageData } from '../resolve-pkg-data';
 import { resolvePackageData } from '../resolve-pkg-data';
 import type { Workspace } from '@teambit/workspace';
 import type { DependencyResolverMain } from '@teambit/dependency-resolver';
+import { isPlusVersion, resolvePlusVersion } from '@teambit/dependency-resolver';
 import type { Consumer } from '@teambit/legacy.consumer';
 import type { ComponentMap } from '@teambit/legacy.bit-map';
 import type { Logger } from '@teambit/logger';
@@ -245,7 +247,9 @@ export class ApplyOverrides {
   }
 
   private async loadAutoDetectOverrides() {
-    this.autoDetectOverrides = await this.workspace?.getAutoDetectOverrides(
+    // outside a workspace, they're calculated by the caller (if at all) and set before this runs
+    if (!this.workspace) return;
+    this.autoDetectOverrides = await this.workspace.getAutoDetectOverrides(
       this.component.extensions,
       this.component.id,
       this.component.files,
@@ -290,12 +294,30 @@ export class ApplyOverrides {
 
   private _getComponentIdToAdd(
     dependency: string,
-    versionRange: string
-  ): { componentId?: ComponentID; packageName?: string; versionRange: string } {
+    versionRange: string,
+    depField: string
+  ): { componentId?: ComponentID; packageName?: string; versionRange?: string } {
+    if (!this.consumer) {
+      // a scope has no node_modules to resolve the package from. if it's a component dependency, use it. otherwise, a
+      // forced component dependency (e.g. an env's own peer, which is a runtime dep of the env) is added as a package
+      // and then dropped in favor of the component dependency, which may be in a different field.
+      const compDep = this.findComponentDepByPackageName(dependency);
+      if (compDep) {
+        // same as the workspace (see updateDependenciesVersions), only a peer component dependency keeps its range
+        const range = depField === 'peerDependencies' ? versionRange : undefined;
+        return { componentId: compDep.id, packageName: dependency, versionRange: range };
+      }
+    }
     const packageData = this._resolvePackageData(dependency);
     return { componentId: packageData?.componentId, packageName: packageData?.name, versionRange };
   }
 
+  private findComponentDepByPackageName(packageName: string): Dependency | undefined {
+    const { dependencies, devDependencies, peerDependencies } = this.allDependencies;
+    const isMatch = (dep: Dependency) => dep.packageName === packageName;
+    return dependencies.find(isMatch) || devDependencies.find(isMatch) || peerDependencies.find(isMatch);
+  }
+
   getDependenciesToAddManually(
     packageJson: Record<string, any> | null | undefined,
     existingDependencies: AllDependencies
@@ -309,7 +331,7 @@ export class ApplyOverrides {
       if (!overrides[depField]) return;
       Object.keys(overrides[depField]).forEach((dependency) => {
         const dependencyValue = overrides[depField][dependency];
-        const componentData = this._getComponentIdToAdd(dependency, dependencyValue);
+        const componentData = this._getComponentIdToAdd(dependency, dependencyValue, depField);
         if (componentData?.componentId) {
           if (componentData.componentId.isEqualWithoutVersion(this.componentId)) {
             this.logger.warn(
@@ -589,10 +611,7 @@ export class ApplyOverrides {
 
   private isPackageAutoDetected(pkgName: string, originallyExists: string[], missingPackages: string[]): boolean {
     // Check component dependencies
-    const existsInAnyCompDeps =
-      this.allDependencies.dependencies.some((dep) => dep.packageName === pkgName) ||
-      this.allDependencies.devDependencies.some((dep) => dep.packageName === pkgName) ||
-      this.allDependencies.peerDependencies.some((dep) => dep.packageName === pkgName);
+    const existsInAnyCompDeps = Boolean(this.findComponentDepByPackageName(pkgName));
 
     // Check originAllPackagesDependencies instead of allPackagesDependencies
     // as it might be already removed at this point if it was set with "-" in runtime/dev
@@ -716,7 +735,11 @@ export class ApplyOverrides {
       comp.versionRange = pkgVal;
       this.allDependencies.peerDependencies.push(comp);
     } else {
-      this.allPackagesDependencies[key][pkgName] = pkgVal;
+      // a package has no separate version and range, so a "+" placeholder is resolved here.
+      // a component dep keeps it in the versionRange, and it's resolved when generating the package.json
+      this.allPackagesDependencies[key][pkgName] = isPlusVersion(pkgVal)
+        ? resolvePlusVersion(pkgVal, this.resolveEnvPeerDepVersion(pkgName, true))
+        : pkgVal;
     }
 
     if (existsInCompsPeerDeps) {
@@ -750,11 +773,11 @@ export class ApplyOverrides {
     });
     const resolvedEnvPolicyManifest = Object.keys(envPolicyManifest).reduce((acc, pkgName) => {
       const version = envPolicyManifest[pkgName];
-      if (version !== '+') {
+      if (!isPlusVersion(version)) {
         acc[pkgName] = version;
         return acc;
       }
-      acc[pkgName] = this.resolveEnvPeerDepVersion(pkgName);
+      acc[pkgName] = resolvePlusVersion(version, this.resolveEnvPeerDepVersion(pkgName));
       return acc;
     }, {});
     // TODO: handle component deps once we support peers between components
@@ -765,21 +788,34 @@ export class ApplyOverrides {
   }
 
   /**
-   * in the env.jsonc file, a policy-peer package can have `+` sign in the version. it means that it should be resolved
+   * in the env.jsonc file, a policy-peer package can have `+` sign (or `+^`/`+~`) in the version. it means that it should be resolved
    * from the workspace. whatever version is installed/imported in the workspace, it should be used here.
    * in some cases, the package is not installed in the workspace, for example, the env is now imported without the
    * dep. so the dep is not in the node_modules.
    * strategy should be: .bitmap, workspace.jsonc, then model.
    * it's not in .bitmap, otherwise, it was linked and `_resolvePackageData` would have found it.
    * so either, it's in the workspace.jsonc or in the model.
+   * @param preferWorkspacePolicy check the workspace.jsonc before what's installed. needed for a package that the
+   * component gets with a plus version. what's installed for the component was installed according to the version it
+   * had before, so it doesn't follow an upgrade in the workspace.jsonc (e.g. by "bit update").
    */
-  private resolveEnvPeerDepVersion(pkgName: string): string {
+  private resolveEnvPeerDepVersion(pkgName: string, preferWorkspacePolicy = false): string {
+    const wsPolicy = this.depsResolver.getWorkspacePolicyManifest();
+    const wsVersion = wsPolicy?.dependencies?.[pkgName] || wsPolicy?.peerDependencies?.[pkgName];
     const resolved = this._resolvePackageData(pkgName);
+    if (preferWorkspacePolicy && wsVersion) {
+      // the workspace.jsonc has usually a range. the plus version needs a concrete version to add its own prefix to
+      if (resolved?.concreteVersion && semver.satisfies(resolved.concreteVersion, wsVersion)) {
+        return resolved.concreteVersion;
+      }
+      const validRange = semver.validRange(wsVersion);
+      // an unconstrained range (e.g. "*") has no meaningful minimum, keep it as is
+      if (!validRange || validRange === '*') return wsVersion;
+      return semver.minVersion(wsVersion)?.version || wsVersion;
+    }
     if (resolved && resolved.concreteVersion) {
       return resolved.concreteVersion;
     }
-    const wsPolicy = this.depsResolver.getWorkspacePolicyManifest();
-    const wsVersion = wsPolicy?.dependencies?.[pkgName] || wsPolicy?.peerDependencies?.[pkgName];
     if (wsVersion) {
       return wsVersion;
     }

package/dependencies-loader/dependencies-loader.ts

@@ -15,6 +15,7 @@ import { DependencyResolverAspect } from '@teambit/dependency-resolver';
 import type { DevFilesMain } from '@teambit/dev-files';
 import type { Logger } from '@teambit/logger';
 import type { AspectLoaderMain } from '@teambit/aspect-loader';
+import type { DependenciesOverridesData } from '@teambit/legacy.consumer-config';
 import { DependenciesData } from './dependencies-data';
 import { updateDependenciesVersions } from './dependencies-versions-resolver';
 import type { DebugDependencies } from './auto-detect-deps';
@@ -62,12 +63,17 @@ export class DependenciesLoader {
     };
   }
 
-  async loadFromScope(dependenciesData: Partial<DependenciesData>) {
+  /**
+   * `autoDetectOverrides` are the non-force policy entries (versions for dependencies that were detected). a workspace
+   * calculates them on its own, a scope gets them from the caller.
+   */
+  async loadFromScope(dependenciesData: Partial<DependenciesData>, autoDetectOverrides?: DependenciesOverridesData) {
     const applyOverrides = new ApplyOverrides(this.component, this.depsResolver, this.logger);
     const { allDependencies, allPackagesDependencies, issues } = dependenciesData;
     if (allDependencies) applyOverrides.allDependencies = allDependencies;
     if (allPackagesDependencies) applyOverrides.allPackagesDependencies = allPackagesDependencies;
     if (issues) applyOverrides.issues = issues;
+    if (autoDetectOverrides) applyOverrides.autoDetectOverrides = autoDetectOverrides;
     const results = await applyOverrides.getDependenciesData();
     this.setDependenciesDataOnComponent(results.dependenciesData, results.overridesDependencies);
   }

package/dependencies-loader/dependencies-versions-resolver.ts

@@ -8,6 +8,7 @@ import { isEmpty } from 'lodash';
 import type { Dependency, Dependencies, ConsumerComponent as Component } from '@teambit/legacy.consumer-component';
 import type { ExtensionDataEntry, ExtensionDataList } from '@teambit/legacy.extension-data';
 import type { DependencyResolverMain } from '@teambit/dependency-resolver';
+import { isPlusVersion } from '@teambit/dependency-resolver';
 import { DEPENDENCIES_FIELDS } from '@teambit/legacy.constants';
 import type OverridesDependencies from './overrides-dependencies';
 import type { DebugComponentsDependency } from './auto-detect-deps';
@@ -126,7 +127,7 @@ export async function updateDependenciesVersions(
       ) {
         dependency.versionRange = `${componentRangePrefix}${resolvedVersion}`;
       }
-    } else if (dependency.versionRange && depType !== 'peerDependencies' && dependency.versionRange !== '+') {
+    } else if (dependency.versionRange && depType !== 'peerDependencies' && !isPlusVersion(dependency.versionRange)) {
       dependency.versionRange = undefined;
     }
   }

package/dependencies-loader/overrides-dependencies.ts

@@ -1,5 +1,6 @@
-import { DEPENDENCIES_FIELDS, MANUALLY_ADD_DEPENDENCY, MANUALLY_REMOVE_DEPENDENCY } from '@teambit/legacy.constants';
+import { DEPENDENCIES_FIELDS, MANUALLY_REMOVE_DEPENDENCY } from '@teambit/legacy.constants';
 import { logger } from '@teambit/legacy.logger';
+import { isPlusVersion, resolvePlusVersion } from '@teambit/dependency-resolver';
 import type { ConsumerComponent as Component, ManuallyChangedDependencies } from '@teambit/legacy.consumer-component';
 import type { FileType } from './auto-detect-deps';
 
@@ -75,14 +76,15 @@ export default class OverridesDependencies {
     packageJson: Record<string, any> | null | undefined
   ): Record<string, any> | null | undefined {
     const packageVersionToAdd = (): string | null | undefined => {
-      if (dependencyValue !== MANUALLY_ADD_DEPENDENCY) {
+      // "+", "+^" and "+~" take the version from the package.json
+      if (!isPlusVersion(dependencyValue)) {
         return dependencyValue;
       }
       if (!packageJson) return null;
       for (const depField of DEPENDENCIES_FIELDS) {
         if (packageJson[depField]) {
           const found = Object.keys(packageJson[depField]).find((pkg) => pkg === dependency);
-          if (found) return packageJson[depField][dependency];
+          if (found) return resolvePlusVersion(dependencyValue, packageJson[depField][dependency]);
         }
       }
       return null;

package/dist/dependencies-loader/apply-overrides.d.ts

@@ -93,6 +93,7 @@ export declare class ApplyOverrides {
     private removeIgnoredPackagesByOverrides;
     private _resolvePackageData;
     private _getComponentIdToAdd;
+    private findComponentDepByPackageName;
     getDependenciesToAddManually(packageJson: Record<string, any> | null | undefined, existingDependencies: AllDependencies): {
         components: Record<string, any>;
         packages: Record<string, any>;
@@ -129,13 +130,16 @@ export declare class ApplyOverrides {
     private applyPackageVersion;
     private applyAutoDetectedPeersFromEnvOnEnvItSelf;
     /**
-     * in the env.jsonc file, a policy-peer package can have `+` sign in the version. it means that it should be resolved
+     * in the env.jsonc file, a policy-peer package can have `+` sign (or `+^`/`+~`) in the version. it means that it should be resolved
      * from the workspace. whatever version is installed/imported in the workspace, it should be used here.
      * in some cases, the package is not installed in the workspace, for example, the env is now imported without the
      * dep. so the dep is not in the node_modules.
      * strategy should be: .bitmap, workspace.jsonc, then model.
      * it's not in .bitmap, otherwise, it was linked and `_resolvePackageData` would have found it.
      * so either, it's in the workspace.jsonc or in the model.
+     * @param preferWorkspacePolicy check the workspace.jsonc before what's installed. needed for a package that the
+     * component gets with a plus version. what's installed for the component was installed according to the version it
+     * had before, so it doesn't follow an upgrade in the workspace.jsonc (e.g. by "bit update").
      */
     private resolveEnvPeerDepVersion;
     /**

package/dist/dependencies-loader/apply-overrides.js

@@ -11,6 +11,13 @@ function _path() {
   };
   return data;
 }
+function _semver() {
+  const data = _interopRequireDefault(require("semver"));
+  _semver = function () {
+    return data;
+  };
+  return data;
+}
 function _componentId() {
   const data = require("@teambit/component-id");
   _componentId = function () {
@@ -67,6 +74,13 @@ function _resolvePkgData() {
   };
   return data;
 }
+function _dependencyResolver() {
+  const data = require("@teambit/dependency-resolver");
+  _dependencyResolver = function () {
+    return data;
+  };
+  return data;
+}
 function _legacy4() {
   const data = require("@teambit/legacy.consumer-config");
   _legacy4 = function () {
@@ -285,7 +299,9 @@ class ApplyOverrides {
     if (!missingIssue.data.length) this.issues.delete(_componentIssues().IssuesClasses.MissingPackagesDependenciesOnFs);
   }
   async loadAutoDetectOverrides() {
-    this.autoDetectOverrides = await this.workspace?.getAutoDetectOverrides(this.component.extensions, this.component.id, this.component.files, this.getEnvExtendsDeps());
+    // outside a workspace, they're calculated by the caller (if at all) and set before this runs
+    if (!this.workspace) return;
+    this.autoDetectOverrides = await this.workspace.getAutoDetectOverrides(this.component.extensions, this.component.id, this.component.files, this.getEnvExtendsDeps());
   }
   cloneAllPackagesDependencies() {
     this.originAllPackagesDependencies = (0, _lodash().cloneDeep)(this.allPackagesDependencies);
@@ -311,7 +327,22 @@ class ApplyOverrides {
     const packageObject = (0, _resolvePkgData().resolvePackageData)(basePath, modulePath);
     return packageObject;
   }
-  _getComponentIdToAdd(dependency, versionRange) {
+  _getComponentIdToAdd(dependency, versionRange, depField) {
+    if (!this.consumer) {
+      // a scope has no node_modules to resolve the package from. if it's a component dependency, use it. otherwise, a
+      // forced component dependency (e.g. an env's own peer, which is a runtime dep of the env) is added as a package
+      // and then dropped in favor of the component dependency, which may be in a different field.
+      const compDep = this.findComponentDepByPackageName(dependency);
+      if (compDep) {
+        // same as the workspace (see updateDependenciesVersions), only a peer component dependency keeps its range
+        const range = depField === 'peerDependencies' ? versionRange : undefined;
+        return {
+          componentId: compDep.id,
+          packageName: dependency,
+          versionRange: range
+        };
+      }
+    }
     const packageData = this._resolvePackageData(dependency);
     return {
       componentId: packageData?.componentId,
@@ -319,6 +350,15 @@ class ApplyOverrides {
       versionRange
     };
   }
+  findComponentDepByPackageName(packageName) {
+    const {
+      dependencies,
+      devDependencies,
+      peerDependencies
+    } = this.allDependencies;
+    const isMatch = dep => dep.packageName === packageName;
+    return dependencies.find(isMatch) || devDependencies.find(isMatch) || peerDependencies.find(isMatch);
+  }
   getDependenciesToAddManually(packageJson, existingDependencies) {
     const overrides = this.overridesDependencies.getDependenciesToAddManually();
     if (!overrides) return undefined;
@@ -329,7 +369,7 @@ class ApplyOverrides {
       if (!overrides[depField]) return;
       Object.keys(overrides[depField]).forEach(dependency => {
         const dependencyValue = overrides[depField][dependency];
-        const componentData = this._getComponentIdToAdd(dependency, dependencyValue);
+        const componentData = this._getComponentIdToAdd(dependency, dependencyValue, depField);
         if (componentData?.componentId) {
           if (componentData.componentId.isEqualWithoutVersion(this.componentId)) {
             this.logger.warn(`component ${this.componentId.toString()} depends on itself ${componentData.componentId.toString()}. ignoring it.`);
@@ -577,7 +617,7 @@ class ApplyOverrides {
   }
   isPackageAutoDetected(pkgName, originallyExists, missingPackages) {
     // Check component dependencies
-    const existsInAnyCompDeps = this.allDependencies.dependencies.some(dep => dep.packageName === pkgName) || this.allDependencies.devDependencies.some(dep => dep.packageName === pkgName) || this.allDependencies.peerDependencies.some(dep => dep.packageName === pkgName);
+    const existsInAnyCompDeps = Boolean(this.findComponentDepByPackageName(pkgName));
 
     // Check originAllPackagesDependencies instead of allPackagesDependencies
     // as it might be already removed at this point if it was set with "-" in runtime/dev
@@ -658,7 +698,9 @@ class ApplyOverrides {
       comp.versionRange = pkgVal;
       this.allDependencies.peerDependencies.push(comp);
     } else {
-      this.allPackagesDependencies[key][pkgName] = pkgVal;
+      // a package has no separate version and range, so a "+" placeholder is resolved here.
+      // a component dep keeps it in the versionRange, and it's resolved when generating the package.json
+      this.allPackagesDependencies[key][pkgName] = (0, _dependencyResolver().isPlusVersion)(pkgVal) ? (0, _dependencyResolver().resolvePlusVersion)(pkgVal, this.resolveEnvPeerDepVersion(pkgName, true)) : pkgVal;
     }
     if (existsInCompsPeerDeps) {
       existsInCompsPeerDeps.versionRange = pkgVal;
@@ -685,11 +727,11 @@ class ApplyOverrides {
     });
     const resolvedEnvPolicyManifest = Object.keys(envPolicyManifest).reduce((acc, pkgName) => {
       const version = envPolicyManifest[pkgName];
-      if (version !== '+') {
+      if (!(0, _dependencyResolver().isPlusVersion)(version)) {
         acc[pkgName] = version;
         return acc;
       }
-      acc[pkgName] = this.resolveEnvPeerDepVersion(pkgName);
+      acc[pkgName] = (0, _dependencyResolver().resolvePlusVersion)(version, this.resolveEnvPeerDepVersion(pkgName));
       return acc;
     }, {});
     // TODO: handle component deps once we support peers between components
@@ -697,21 +739,34 @@ class ApplyOverrides {
   }
 
   /**
-   * in the env.jsonc file, a policy-peer package can have `+` sign in the version. it means that it should be resolved
+   * in the env.jsonc file, a policy-peer package can have `+` sign (or `+^`/`+~`) in the version. it means that it should be resolved
    * from the workspace. whatever version is installed/imported in the workspace, it should be used here.
    * in some cases, the package is not installed in the workspace, for example, the env is now imported without the
    * dep. so the dep is not in the node_modules.
    * strategy should be: .bitmap, workspace.jsonc, then model.
    * it's not in .bitmap, otherwise, it was linked and `_resolvePackageData` would have found it.
    * so either, it's in the workspace.jsonc or in the model.
+   * @param preferWorkspacePolicy check the workspace.jsonc before what's installed. needed for a package that the
+   * component gets with a plus version. what's installed for the component was installed according to the version it
+   * had before, so it doesn't follow an upgrade in the workspace.jsonc (e.g. by "bit update").
    */
-  resolveEnvPeerDepVersion(pkgName) {
+  resolveEnvPeerDepVersion(pkgName, preferWorkspacePolicy = false) {
+    const wsPolicy = this.depsResolver.getWorkspacePolicyManifest();
+    const wsVersion = wsPolicy?.dependencies?.[pkgName] || wsPolicy?.peerDependencies?.[pkgName];
     const resolved = this._resolvePackageData(pkgName);
+    if (preferWorkspacePolicy && wsVersion) {
+      // the workspace.jsonc has usually a range. the plus version needs a concrete version to add its own prefix to
+      if (resolved?.concreteVersion && _semver().default.satisfies(resolved.concreteVersion, wsVersion)) {
+        return resolved.concreteVersion;
+      }
+      const validRange = _semver().default.validRange(wsVersion);
+      // an unconstrained range (e.g. "*") has no meaningful minimum, keep it as is
+      if (!validRange || validRange === '*') return wsVersion;
+      return _semver().default.minVersion(wsVersion)?.version || wsVersion;
+    }
     if (resolved && resolved.concreteVersion) {
       return resolved.concreteVersion;
     }
-    const wsPolicy = this.depsResolver.getWorkspacePolicyManifest();
-    const wsVersion = wsPolicy?.dependencies?.[pkgName] || wsPolicy?.peerDependencies?.[pkgName];
     if (wsVersion) {
       return wsVersion;
     }