4 ms·
By doing that they would avoid this issue, for sure. They would also introduce security issues by using old versions. And this would do nothing for the fact th
by mikewhy 6y ago
By doing that they would avoid this issue, for sure. They would also introduce security issues by using old versions.
And this would do nothing for the fact that `npm install eslint && ./node_modules/.bin/eslint` was also failing.
- montroser 6y agoIt's not like pinning means you can /never/ update. You just get to do it on your own schedule. You can even automate updating to some degree -- running your tests against the latest everything and then locking in to those versions of all goes well.
- mikewhy 6y agoAgain, this only works for project skeletons, and not for any other package that happened to have a transient dependency on `is-promise` (which is a lot more than project skeletons).
- tirpen 6y agoPinning dependencies might introduce security issues. Not pinning dependencies is a security issue.