3 ms·
> pin your dependency versions for projects running in production Works for existing apps, but people using create-react-app and angular CLI can't even start a
by mikewhy 6y ago
> pin your dependency versions for projects running in production
Works for existing apps, but people using create-react-app and angular CLI can't even start a new project.
- staticassertion 6y agoI don't know much about those projects, but why did this break them? Are they not pinning versions?
- yandie 6y agoBecause they are starting a new project from scratch and would have nothing to pin their dependencies against?
- staticassertion 6y agoMaybe I'm misunderstanding how those projects work. From what I recall, they generate a project, including the package.json. So I'm not sure why they couldn't just generate the package.json with pinned versions? I don't write much JS, and have only used create-react-app just a few times, so feel free to explain why this isn't possible.
- mikewhy 6y agopackage.json only lists top-level dependencies. package-lock.json tracks all dependencies, and dependencies of dependencies. is-promise is one of those dependencies of a dependency, which you don't have much control over.
- rsanek 6y agoHow could a dependency-of-dependency change version if one of the direct dependencies doesn't change version? I guess, if the direct dependency isn't pinning that version? Another case of, everyone should be pinning dependencies.
- mikewhy 6y agoExactly, node's conventions are to allow a range of versions (semver compatible). True, if all dependencies were pinned, this wouldn't come up as often. That also means that there would be a lot more updating when security issues are found.
- staticassertion 6y agoHow would a top level dependency change versions if it bumped a transitive dependency? Is that a thing in js-land?
- montroser 6y agoNah, create-react-app and others could easily pin dependencies of libraries they install in your new project to known-good versions. Without doing that bit of diligence, this type of issue should be 100% expected.
- mikewhy 6y agoBy doing that they would avoid this issue, for sure. They would also introduce security issues by using old versions. And this would do nothing for the fact that `npm install eslint && ./node_modules/.bin/eslint` was also failing.
- montroser 6y agoIt's not like pinning means you can /never/ update. You just get to do it on your own schedule. You can even automate updating to some degree -- running your tests against the latest everything and then locking in to those versions of all goes well.
- mikewhy 6y agoAgain, this only works for project skeletons, and not for any other package that happened to have a transient dependency on `is-promise` (which is a lot more than project skeletons).
- tirpen 6y agoPinning dependencies might introduce security issues. Not pinning dependencies is a security issue.
- oefrha 6y agoThen you can’t upgrade anything unless create-react-app releases a new version (or you eject), which, in addition to the obvious release cadence problem, might introduce other compatibility problems.