4 ms·
package.json only lists top-level dependencies. package-lock.json tracks all dependencies, and dependencies of dependencies. is-promise is one of those dependen
by mikewhy 6y ago
package.json only lists top-level dependencies. package-lock.json tracks all dependencies, and dependencies of dependencies. is-promise is one of those dependencies of a dependency, which you don't have much control over.
- rsanek 6y agoHow could a dependency-of-dependency change version if one of the direct dependencies doesn't change version? I guess, if the direct dependency isn't pinning that version? Another case of, everyone should be pinning dependencies.
- mikewhy 6y agoExactly, node's conventions are to allow a range of versions (semver compatible). True, if all dependencies were pinned, this wouldn't come up as often. That also means that there would be a lot more updating when security issues are found.
- staticassertion 6y agoHow would a top level dependency change versions if it bumped a transitive dependency? Is that a thing in js-land?