大家怎么解决 node_modules 里面， 引用的第三方包的深度依赖需要升级，但是直接依赖“不 需要/想 升级”的情况？

yarn 本来有一个解决方案，可惜，没有实现
例如： https://github.com/yarnpkg/rfcs/blob/master/implemented/0000-selective-versions-resolutions.md#package-designation

Mapping version specifications This is a kind of simplified solution to the "out-of-scope scenario" presented in the Motivations section above (it maps versions but not dependency names).

It was proposed in this comment.

It is similar to the previous alternative but with a version specification in the package designation. This would take this form in the package.json:

 "devDependencies": { "@angular/cli": "1.0.3", "typescript": "2.2.2", "more dependencies..." }, "resolutions": { "typescript@>=2.0.0 <2.3.0": "[email protected]" } 

yarn would then replace matching version specifications with the user's one. For example a dependency normally resolved to [email protected] would be resolved in practice to [email protected].

This is too advanced and can be considered a possible extension of this RFC. 

这个功能太高级了，考虑一下要不要做进去......