Description
The issue is hit with this docker file (commit 97830ce).
On the command opam install . --deps-only [..] opam installs quickjs.0.1.1 even thought the opam file contains the constraint "quickjs" { >= "1.2.0"}.
Digging on it, the issue is in the deps only mechanism. A pin is simulated on local packages, then a fake package is created with all its dependencies to be resolved/installed (and removed at the last minute).
But the package itself is not marked as pinned, and the propagated information is the name of the local package, not its version. So opam end up creating fake package for all known versions (if the package is present in a repo) of the local package name, and give that to resolve. It some cases, the solution does not take then the local version of the package, but installs the dependencies of a repository version of the package.
In the server-reason-react case, it installs dependencies of version 0.3.0 which contains "quickjs" {>= "0.1.1" & < "0.1.2"}.
Usually the bug is not hit as the solver tries to install the lastest version, and the local one is usually the latest version.
/cc @davesnx
Activity