4 ms·

There are a number of really good (separate) points here: 1. Shrink-wrapping: yes, of course. Semver ranges never made sense to me. All changes are breaking ch

There are a number of really good (separate) points here: 1. Shrink-wrapping: yes, of course. Semver ranges never made sense to me. All changes are breaking changes. The idea that we could safely auto-upgrade a project is insane. A semver range is an open invitation to allow people not on your team to arbitrarily change your code at any time in the future. If it was up to me, npm install -save would just shrink-wrap. The idea behind semver ranges is fundamentally flawed since it relies on a human making a determination of whether the change is patch or major or what have you. Even if you automate it and tie it to tests you can't know for sure: Even in a magical world where a "patch" upgrade could be guaranteed to not actually break behavior, it could still have dire perf consequences (which in an async world could absolutely change the behavior of your running program by surfacing new race conditions or what have you). That's why this is the behavior on tonicdev.com: when you require a package we magically shrink-wrap it at that point in time. Reproducibility should be the default. All changes are breaking changes. 2. The quickness of change is definitely also an issue. This may just be a price of progress thing though. I certainly wouldn't want to give up amazing rewrite the world changes like the development of React for a "stable" environment. I can also see the flip side to this though.

cjhveal 11y ago
For what it's worth, w.r.t. your first point you can get part of the way there by creating a .npmrc in your project with "save-exact=true". Even if it doesn't protect you from higher order dependencies that violate semver, it will peg all saved dependencies to an exact version (even by other engineers). But alas, even that sometimes doesn't give you any guarantees with the (albeit rare) force publish. Better than nothing, though.

cjhveal 11y ago

For what it's worth, w.r.t. your first point you can get part of the way there by creating a .npmrc in your project with "save-exact=true". Even if it doesn't protect you from higher order dependencies that violate semver, it will peg all saved dependencies to an exact version (even by other engineers). But alas, even that sometimes doesn't give you any guarantees with the (albeit rare) force publish. Better than nothing, though.