Allowing not-semver dependencies in package.json, e.g. to link to github repo

We have a patched version of a library that we want to depend on. In a “regular” node project, we would do this by setting this in package.json

  "dependencies": {
    ...
    "thelibrary": "git+https://github.com/myOrg/myFork.git"
  }

(see https://docs.npmjs.com/cli/v8/configuring-npm/package-json#urls-as-dependencies)

However, with Vaadin this is not possible, as during the buildFrontend task the reference of each package is checked to be a semver-string (here: https://github.com/vaadin/flow/blob/fd04f545ee3f13b0cf3cdf2b694c6d9ab215c689/flow-server/src/main/java/com/vaadin/flow/server/frontend/FrontendVersion.java ).

Is this intentional, that one can only insert semver strings here? Or asked the other way round, why can’t I use custom urls or local paths like it is possible with pure node projects?

It is supposed to work with anything. There are even some test that uses a local package so it sounds like a bug

Ok, thanks, then I’ll see I can build a minimal example

On what version are you? I think that the commit to make it work is only included in 23.2 (https://github.com/vaadin/flow/pull/14233)

I was on 23.1.2, just trying to migrate to 23.2

Ha, sorry… it was in { “vaadin”: { “dependencies” : … } }, not directly in “dependencies”, and there it seems like only semver-versions are allowed.
Putting it into { “dependencies”: { … } } directly, lead to the warning but still the project builds using Vaadin 23.2