3 ms·
I am not familiar with npm package maintenance. Can somebody explain these two recommendations to me? Package maintainers should be careful with using
by TekMol 8y ago
I am not familiar with npm package maintenance. Can somebody explain these two recommendations to me?
Package maintainers should be careful with using
any services that auto-merge dependency upgrades.
What is an example of such a service? What is an 'auto-merge' of 'dependency upgrades'?
Application developers should use a lockfile
(package-lock.json or yarn.lock) to prevent the
auto-install of new packages.
What is an auto-install of a new package? What triggers it?
- Guillaume86 8y agoI guess there's CI services that pull latest versions of dependencies (in the accepted version range), build, run tests and submit a pull request if everything seems ok. Edit: actually no I don't know, there would be nothing to submit if no lockfile is used.