4 ms·

Code smells if a change works with one lockfile but not another generated around the same time. The utility of a lockfile increases with the age of the file. W

Code smells if a change works with one lockfile but not another generated around the same time. The utility of a lockfile increases with the age of the file. We expect lockfiles to change when we update it add dependencies. If a pull request cannot build with a lockfile generated when it is merged then that change should not be merged.

allover 7y ago
> Code smells if a change works with one lockfile but not another generated around the same time. This isn't true at all. You can't predict when a new, potentially breaking, version of a dependency might get published. It could happen a second after you generate your lockfile, or create your PR. At time of PR creation we could have versions 1, 2, 3 and 4 of our transitive dependencies. At time of merge we could have versions 1.1, 2.2, 3.3 and 4.x available. Dependencies are outside of your control, so always "smell", that's why it's crazy to do anything other than pin the heck out of them.