3 ms·
One of the really nice things about NPM (and other modern source-level dependency managers) is that it's trivial to fork dependencies and reference commits in r
by Benjamin_Dobell 9y ago
One of the really nice things about NPM (and other modern source-level dependency managers) is that it's trivial to fork dependencies and reference commits in remote Git repositories. This workflow makes it really straight forward to patch third-party dependencies. Combine it with a lock file for reproducible builds and you're good to go with minimal fuss.
- Sujan 9y agoHow (well) does this work in a dependency of a dependency of a dependency?
- Benjamin_Dobell 9y agoYou have three options: 1. Fork every dependency in the chain. Which typically isn't more than two or three dependencies. 2. Fork the distant dependency, and specify it as a direct dependency. 3. Fork the distant dependency, and only update your lock file. Option 1 is probably the "correct" approach, and sometimes necessary anyway, if you've made contract/API changes to a dependency of a dependency. It will also make it easier to contribute your changes upstream - which presumably you're wanting to do to avoid the maintenance burden of maintaining forks. Option 2 is the "easiest", but probably least correct as you're adding a hard dependency where one shouldn't exist. Option 3 works fine until you try regenerate your lock file. Quickfix doesn't seem to take itself too seriously, which is nice, but I'd happily argue that any one of the 3 approaches given above is better than the approach Quickfix is taking.