4 ms·
Maybe I'm misunderstanding how those projects work. From what I recall, they generate a project, including the package.json. So I'm not sure why they couldn't j
by staticassertion 6y ago
Maybe I'm misunderstanding how those projects work. From what I recall, they generate a project, including the package.json. So I'm not sure why they couldn't just generate the package.json with pinned versions?
I don't write much JS, and have only used create-react-app just a few times, so feel free to explain why this isn't possible.
- mikewhy 6y agopackage.json only lists top-level dependencies. package-lock.json tracks all dependencies, and dependencies of dependencies. is-promise is one of those dependencies of a dependency, which you don't have much control over.
- rsanek 6y agoHow could a dependency-of-dependency change version if one of the direct dependencies doesn't change version? I guess, if the direct dependency isn't pinning that version? Another case of, everyone should be pinning dependencies.
- mikewhy 6y agoExactly, node's conventions are to allow a range of versions (semver compatible). True, if all dependencies were pinned, this wouldn't come up as often. That also means that there would be a lot more updating when security issues are found.
- staticassertion 6y agoHow would a top level dependency change versions if it bumped a transitive dependency? Is that a thing in js-land?