Singleton sharing ignored for major version mismatch despite strictVersion: false

[RanjithNair]

With what library do you have an issue?

native-federation

Reproduction of the bug/regression with instructions

I am observing an issue where singleton sharing fails to enforce the use of the host's dependency version when there is a major version mismatch between the host and remote, even when strictVersion is explicitly set to false.

In a setup with an App Shell (Host) and an MFE (Remote), the Remote continues to use its local version (v2.4.2) instead of the Host's version (v4.17.23), effectively ignoring the singleton: true configuration.

This behavior differs from Module Federation, where the same configuration successfully forces the Remote to use the Host's version.

minimal reproduction scenarios

• Host (App Shell): Installs lodash@4.17.23
• Remote (mfe1): Installs lodash@2.4.2

Configuration

Host federation.config.js:

module.exports = withNativeFederation({
  // ...
  shared: {
    lodash: {
      singleton: true,
      strictVersion: true,
      requiredVersion: '4.17.23',
    },
  },
});

Remote federation.config.js:

module.exports = withNativeFederation({
  // ...
  shared: {
    lodash: {
      singleton: true,
      strictVersion: false, // Intentionally disabled to allow version mismatch
      requiredVersion: '4.17.23',
    },
  },
});

Expected behavior

Expected Behavior

Since singleton: true is set, the Remote (mfe1) should use the shared instance of Lodash provided by the Host (v4.17.23) at runtime.

Observed Behavior

At runtime, the Remote (mfe1) initializes and uses its own local version of Lodash (v2.4.2). The Host uses v4.17.23. This results in two different instances/versions of the library running simultaneously, breaking the singleton guarantee.

Versions of Native/Module Federation, Angular, Node, Browser, and operating system

• Library: @angular-architects/native-federation
• Version: ^21.1.0
• Angular Version: ^21.0.0
• Package Manager: npm

I have tried the same with @angular-architects/native-federation-v4 as well and the same issue exists.

Other information

• When checking _.VERSION in the Remote's component, it logs 2.4.2, where host logs 4.17.23
• The same configuration when used with "@angular-architects/module-federation": "^20.0.0", logs 4.17.23 in both host and remote respecting the singleton nature.
• remoteEntry.json for the remote with native federation shows the following generated configuration:

  {
    "packageName": "lodash",
    "outFileName": "lodash.Il_ItxFq35.js",
    "requiredVersion": "4.17.23",
    "singleton": true,
    "strictVersion": false,
    "version": "2.4.2"
  }

I would be willing to submit a PR to fix this issue

• Yes
• No

[Aukevanoost]

Hi @RanjithNair! Yeah this is default behavior for the runtime. If you want dependency sharing I'd recommend switching to the new orchestrator instead (v4). Here's an example:

https://github.com/Aukevanoost/native-federation-examples-ng/blob/2f85d080b7e9ca34e29548338208f343f1a479aa/projects/vnf-host/src/main.ts#L1C1-L4C50

I'd love to know what you think