3 ms·
NPM and Yarn have made a nightmare out of our project. We have 50 direct dependencies. The lockfiles only lock your direct dependencies, any transitive ones can
by 0xfeba 8y ago
NPM and Yarn have made a nightmare out of our project. We have 50 direct dependencies. The lockfiles only lock your direct dependencies, any transitive ones can change at any moment, making our CI builds fail when something works locally. And they don't actually check integrity -- that v1.5.0 of ABC is the same as v1.5.0 from a month ago.
I saw Yarn added last month a hash of the (hopefully) source of the dependencies -- that's what we need.
Despite using lockfiles, some transitive dependency changed and we decided it was best to upgrade the direct dependency, requiring a big refactor. The alternative was to fork the library and maintain it ourselves -- which I am refusing to do from this point on. We have about 10 forked 3rd party libraries. No more.
I feel like I spend 30% of my time just trying to upgrade/maintain the current builds because some stupid loosely semver'd dependency changes, rather than writing new features.
- sosuke 8y agoIf you're still up for solutions my team found success with https://www.npmjs.com/package/npm-git-lock https://www.npmjs.com/package/npm-git-lock when doing CI devops. Big savings in time for us.
- acemarke 8y agoThat sounds odd. The whole point of lockfiles is that they _do_ lock your transitive dependencies.
- oweiler 8y agoSo NPM allows overwriting existing versions of a package?
- 0xfeba 8y agoNPM does not, but GitHub, yarnpkg?, and whatever else may. NPM does allow unpublishing a package altogether, and then you can publish again (AFAIK) with the same version.