Use exact versions for cross-package dependencies

[aaronadamsCA]

Is your feature request related to a problem? Please describe.

If you install a Storybook version older than latest, your lockfile will still end up with transitive dependencies on latest. This is bad, especially for troubleshooting.

See this example, where @storybook/[email protected] depends on @storybook/[email protected]:

  '@storybook/[email protected]([email protected]([email protected]))([email protected])([email protected])([email protected])':
    dependencies:
      '@storybook/components': 8.3.2([email protected])
      '@storybook/global': 5.0.0
      '@storybook/manager-api': 8.3.1([email protected])
      '@storybook/preview-api': 8.3.2([email protected])
      '@storybook/react-dom-shim': 8.3.1([email protected]([email protected]))([email protected])([email protected])
      '@storybook/theming': 8.3.1([email protected])
      '@types/escodegen': 0.0.6
      '@types/estree': 0.0.51
      '@types/node': 22.2.0
      acorn: 7.4.1
      acorn-jsx: 5.3.2([email protected])
      acorn-walk: 7.2.0
      escodegen: 2.1.0
      html-tags: 3.3.1
      prop-types: 15.8.1
      react: 18.3.1
      react-dom: 18.3.1([email protected])
      react-element-to-jsx-string: 15.0.0([email protected]([email protected]))([email protected])
      semver: 7.6.3
      storybook: 8.3.1
      ts-dedent: 2.2.0
      type-fest: 2.19.0
      util-deprecate: 1.0.2
    optionalDependencies:
      typescript: 5.6.2

How this happens:

1. Storybook v8.3.1 is released.
2. Storybook v8.3.2 is released.
3. Renovate opens a Storybook v8.3.1 upgrade PR after a minimumReleaseAge of 3 days.

Why this happens:

• Renovate minimumReleaseAge doesn't apply to transitive dependencies.
• Storybook dependencies use ranged versions.

This results in unmet peer dependencies.

Describe the solution you'd like

Basically just #3183 again.

Describe alternatives you've considered

There is an argument that Renovate could do better here, but I can't think of a good reason for Storybook packages released together to depend on each other using version ranges.

This isn't just a problem for Renovate users. Imagine trying to bisect a problem across Storybook versions without realizing your lockfile contains mismatched transitive dependencies.

Are you able to assist to bring the feature to reality?

no

Additional context

No response