Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unpin dependencies where possible #307

Closed
billyjanitsch opened this issue Mar 4, 2018 · 5 comments · Fixed by #309
Closed

Unpin dependencies where possible #307

billyjanitsch opened this issue Mar 4, 2018 · 5 comments · Fixed by #309

Comments

@billyjanitsch
Copy link
Member

Do you want to request a feature or report a bug?

Bug.

What is the current behavior?

Currently the dependencies on log-symbols and yargs are pinned to exact versions. Is there any reason for this?

(I realize there are reasons not to upgrade yargs to 11.x but it's currently pinned to a specific 9.x version, i.e. 9.0.1 rather than ^9.0.1)

What is the expected behavior?

The dependencies on log-symbols and yargs are declared as ^2.2.0 and ^9.0.1, respectively.

If this is a feature request, what is motivation or use case for changing the behavior?

Generally pinning dependencies is bad for the ecosystem because it prevents deduping between packages.

@dhruvdutt
Copy link
Member

@billyjanitsch You can check comments on this PR #290.

@evenstensberg
Copy link
Member

Thanks for submitting an issue! We (with good purpose) didn't upgrade Yargs, as there was a security compromisation reported from the most recent version!

@billyjanitsch
Copy link
Member Author

billyjanitsch commented Mar 4, 2018

This issue isn't about upgrading, though. It's about unpinning.

The security compromisation is for 11.x, right? I'm suggesting that webpack-cli should depend on yargs@^9.0.1 and log-symbols@^2.2.0 (instead of yargs@9.0.1 and log-symbols@2.2.0). This would not cause yargs 11.x to be installed.

@montogeek
Copy link
Member

What is wrong with have those dependencies pinned?

@billyjanitsch
Copy link
Member Author

@montogeek I mentioned above:

Generally pinning dependencies is bad for the ecosystem because it prevents deduping between packages.

It's not incorrect, it just results in a larger average install size.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants