2 ms·
Any POCs your devs wrote would have been targeted at a specific version of their framework dependencies via their NPM package.json / package-lock.json. So why w
by staminade 3y ago
Any POCs your devs wrote would have been targeted at a specific version of their framework dependencies via their NPM package.json / package-lock.json. So why would any later changes made by framework authors, even backwards incompatible ones, made you unable to run or build them?
- jmull 3y agoI assume they mean they updated their dependencies to the latest. That's somewhat valid. The trap is this: you have a strong need to update a dependency for a bug fix (particularly security fixes), but the update isn't compatible. So you've got no good option: either live with unfixed bugs or pay the price to update your app to the latest version. There is some wiggle room though. (1) libraries will often maintain a compatible branch for important fixes. (2) you can often find and apply just the fix/fixes you want to your own version of the library. Obviously, you start to lose the benefit of someone else maintaining the library for you, but when you aren't paying for it, you should always understand that is a nice but temporary state of affairs, so enjoy it while it lasts. (Actually, even when you are paying -- maybe even a lot -- you can still get left behind.)