Implement dependency conflict detection #33

New Issue

2026-01-03T23:40:27Z

KofTwentyTwo commented

2026-01-03 23:40:27 +00:00

(Migrated from github.com)

Part of #11

User Story

As a developer, I want to be notified of dependency conflicts so I can resolve them before they cause runtime issues.

Design

Conflict Types

Type	Description	Example
Version conflict	Same package, incompatible versions	A needs foo@^2.0, B needs foo@^3.0
Diamond dependency	Transitive deps resolve differently	A->C@2.0, B->C@3.0

Conflict Detection Workflow

Build dependency graph from lockfile + new package
For each package, collect all version constraints
Find intersection of all constraints
If no intersection exists, report conflict

Conflict Report Format

Dependency conflict detected:

Package: @qrun/utils
  Required by @qrun/auth-sso: ^2.0.0 (needs >=2.0.0 <3.0.0)
  Required by @qrun/reports:  ^3.0.0 (needs >=3.0.0 <4.0.0)

No version satisfies both constraints.

Suggestions:
  - Update @qrun/auth-sso to a version compatible with @qrun/utils@^3.0
  - Use --force to install anyway (may cause runtime errors)

Files to Create

File	Description
`qctl-qbit/src/main/java/io/qrun/qctl/qbit/resolve/DependencyGraph.java`	Build and traverse dependency graph
`qctl-qbit/src/main/java/io/qrun/qctl/qbit/resolve/ConflictDetector.java`	Detect and report conflicts
`qctl-qbit/src/main/java/io/qrun/qctl/qbit/resolve/Conflict.java`	Conflict model with details

Integration Points

Called by AddCommand before installing
Called by UpdateCommand before updating
Can be run standalone via qbit check (future)

Implementation Tasks

Create DependencyGraph class to model package relationships
Add method to build graph from lockfile
Add method to add new package to graph
Create ConflictDetector with detection logic
Implement constraint intersection algorithm
Create Conflict model with affected packages and constraints
Format conflict report with suggestions
Integrate into AddCommand workflow
Integrate into UpdateCommand workflow
Add unit tests for graph building
Add unit tests for conflict detection
Add integration test with mock registry

Acceptance Criteria

Detects direct version conflicts
Detects diamond dependency conflicts
Clear error message listing conflicting constraints
Suggests possible resolutions
--force flag bypasses conflict check
Exit code 8 (CONFLICT) on detection

Part of #11 ## User Story As a developer, I want to be notified of dependency conflicts so I can resolve them before they cause runtime issues. ## Design ### Conflict Types | Type | Description | Example | |------|-------------|---------| | Version conflict | Same package, incompatible versions | A needs foo@^2.0, B needs foo@^3.0 | | Diamond dependency | Transitive deps resolve differently | A->C@2.0, B->C@3.0 | ### Conflict Detection Workflow 1. Build dependency graph from lockfile + new package 2. For each package, collect all version constraints 3. Find intersection of all constraints 4. If no intersection exists, report conflict ### Conflict Report Format ``` Dependency conflict detected: Package: @qrun/utils Required by @qrun/auth-sso: ^2.0.0 (needs >=2.0.0 <3.0.0) Required by @qrun/reports: ^3.0.0 (needs >=3.0.0 <4.0.0) No version satisfies both constraints. Suggestions: - Update @qrun/auth-sso to a version compatible with @qrun/utils@^3.0 - Use --force to install anyway (may cause runtime errors) ``` ### Files to Create | File | Description | |------|-------------| | `qctl-qbit/src/main/java/io/qrun/qctl/qbit/resolve/DependencyGraph.java` | Build and traverse dependency graph | | `qctl-qbit/src/main/java/io/qrun/qctl/qbit/resolve/ConflictDetector.java` | Detect and report conflicts | | `qctl-qbit/src/main/java/io/qrun/qctl/qbit/resolve/Conflict.java` | Conflict model with details | ### Integration Points - Called by `AddCommand` before installing - Called by `UpdateCommand` before updating - Can be run standalone via `qbit check` (future) ## Implementation Tasks - [ ] Create `DependencyGraph` class to model package relationships - [ ] Add method to build graph from lockfile - [ ] Add method to add new package to graph - [ ] Create `ConflictDetector` with detection logic - [ ] Implement constraint intersection algorithm - [ ] Create `Conflict` model with affected packages and constraints - [ ] Format conflict report with suggestions - [ ] Integrate into `AddCommand` workflow - [ ] Integrate into `UpdateCommand` workflow - [ ] Add unit tests for graph building - [ ] Add unit tests for conflict detection - [ ] Add integration test with mock registry ## Acceptance Criteria - [ ] Detects direct version conflicts - [ ] Detects diamond dependency conflicts - [ ] Clear error message listing conflicting constraints - [ ] Suggests possible resolutions - [ ] `--force` flag bypasses conflict check - [ ] Exit code 8 (CONFLICT) on detection

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qctl#33