3 ms·
Nah, create-react-app and others could easily pin dependencies of libraries they install in your new project to known-good versions. Without doing that bit of
by montroser 7y ago
Nah, create-react-app and others could easily pin dependencies of libraries they install in your new project to known-good versions.
Without doing that bit of diligence, this type of issue should be 100% expected.
- mikewhy 7y agoBy doing that they would avoid this issue, for sure. They would also introduce security issues by using old versions. And this would do nothing for the fact that `npm install eslint && ./node_modules/.bin/eslint` was also failing.
- montroser 7y agoIt's not like pinning means you can /never/ update. You just get to do it on your own schedule. You can even automate updating to some degree -- running your tests against the latest everything and then locking in to those versions of all goes well.
- mikewhy 7y agoAgain, this only works for project skeletons, and not for any other package that happened to have a transient dependency on `is-promise` (which is a lot more than project skeletons).
- tirpen 7y agoPinning dependencies might introduce security issues. Not pinning dependencies is a security issue.
- oefrha 7y agoThen you can’t upgrade anything unless create-react-app releases a new version (or you eject), which, in addition to the obvious release cadence problem, might introduce other compatibility problems.