2 ms·
If you pin your direct dependency doesn't that mean it can not change versions of its dependencies? The same version number of a package should always link to
by galaxyLogic 5y ago
If you pin your direct dependency doesn't that mean it can not change versions of its dependencies?
The same version number of a package should always link to the same version numbers of both its direct and nested dependencies. No?
- cjonas 5y agoPretty sure pinning only pins the direct dependency. And most libraries do not "pin" their own dependencies, because it's more work to maintain. Security & bugs fixes that would otherwise be resolved via minor patches must be manually addressed. It also helps with resolving shared dependencies. NPM is highly optimized to make sharing code as easily as possible, but that comes at a heavy price.