undefined | Better HN

0 pointsmontroser5y ago0 comments

Nah, create-react-app and others could easily pin dependencies of libraries they install in your new project to known-good versions.

Without doing that bit of diligence, this type of issue should be 100% expected.

0 comments

oefrha5y ago

Then you can’t upgrade anything unless create-react-app releases a new version (or you eject), which, in addition to the obvious release cadence problem, might introduce other compatibility problems.

mikewhy5y ago

By doing that they would avoid this issue, for sure. They would also introduce security issues by using old versions.

And this would do nothing for the fact that `npm install eslint && ./node_modules/.bin/eslint` was also failing.

tirpen5y ago

Pinning dependencies might introduce security issues.

Not pinning dependencies is a security issue.

montroserOP5y ago

It's not like pinning means you can /never/ update. You just get to do it on your own schedule.

You can even automate updating to some degree -- running your tests against the latest everything and then locking in to those versions of all goes well.

mikewhy5y ago

Again, this only works for project skeletons, and not for any other package that happened to have a transient dependency on `is-promise` (which is a lot more than project skeletons).

j / k navigate · click thread line to collapse

0 comments

oefrha5y ago

mikewhy5y ago

By doing that they would avoid this issue, for sure. They would also introduce security issues by using old versions.

And this would do nothing for the fact that `npm install eslint && ./node_modules/.bin/eslint` was also failing.

tirpen5y ago

Pinning dependencies might introduce security issues.

Not pinning dependencies is a security issue.

montroserOP5y ago

It's not like pinning means you can /never/ update. You just get to do it on your own schedule.

You can even automate updating to some degree -- running your tests against the latest everything and then locking in to those versions of all goes well.

mikewhy5y ago

Again, this only works for project skeletons, and not for any other package that happened to have a transient dependency on `is-promise` (which is a lot more than project skeletons).

j / k navigate · click thread line to collapse