3 ms·
Both actually. Even with yarn and lock files, npm servers can (and eventually will) pull a rug from under you. I have already been in a situation where a depen
by yoz-y 9y ago
Both actually. Even with yarn and lock files, npm servers can (and eventually will) pull a rug from under you.
I have already been in a situation where a dependency version that I was locked to was simply removed from the official registry.
The right solution is to have your own registry or backup the archives of dependencies that you are using.
I think it is better to commit the archives rather than the whole node_modules as it does not produce a mess.
- yeukhon 9y agoYeah running a registry is the better option, although another solution is forking / committing the dependencies in a separate repository, and use branch + shallow clone to keep the download size small.
- yoz-y 9y agoWhat I ended up doing at work is to have a docker image of a registry with package zips committed in the repo (with a small script to publish all packages in). That way I can rebuild a running registry in a few moments.