Allowing not-semver dependencies in package.json, e.g. to link to github repo

We have a patched version of a library that we want to depend on. In a “regular” node project, we would do this by setting this in package.json

  "dependencies": {
    "thelibrary": "git+"


However, with Vaadin this is not possible, as during the buildFrontend task the reference of each package is checked to be a semver-string (here: ).

Is this intentional, that one can only insert semver strings here? Or asked the other way round, why can’t I use custom urls or local paths like it is possible with pure node projects?

It is supposed to work with anything. There are even some test that uses a local package so it sounds like a bug

Ok, thanks, then I’ll see I can build a minimal example

On what version are you? I think that the commit to make it work is only included in 23.2 (

I was on 23.1.2, just trying to migrate to 23.2

Ha, sorry… it was in { “vaadin”: { “dependencies” : … } }, not directly in “dependencies”, and there it seems like only semver-versions are allowed.
Putting it into { “dependencies”: { … } } directly, lead to the warning but still the project builds using Vaadin 23.2