-
-
Notifications
You must be signed in to change notification settings - Fork 622
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Unpin dependencies where possible #307
Comments
@billyjanitsch You can check comments on this PR #290. |
Thanks for submitting an issue! We (with good purpose) didn't upgrade Yargs, as there was a security compromisation reported from the most recent version! |
This issue isn't about upgrading, though. It's about unpinning. The security compromisation is for 11.x, right? I'm suggesting that webpack-cli should depend on |
What is wrong with have those dependencies pinned? |
@montogeek I mentioned above:
It's not incorrect, it just results in a larger average install size. |
Do you want to request a feature or report a bug?
Bug.
What is the current behavior?
Currently the dependencies on log-symbols and yargs are pinned to exact versions. Is there any reason for this?
(I realize there are reasons not to upgrade yargs to
11.x
but it's currently pinned to a specific9.x
version, i.e.9.0.1
rather than^9.0.1
)What is the expected behavior?
The dependencies on log-symbols and yargs are declared as
^2.2.0
and^9.0.1
, respectively.If this is a feature request, what is motivation or use case for changing the behavior?
Generally pinning dependencies is bad for the ecosystem because it prevents deduping between packages.
The text was updated successfully, but these errors were encountered: