Thoughts on locking version of "ms" dependency?
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 35/100
- Issue type
- Refactor
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- javascript
- Domain
- tooling
Research direction
First confirm whether maintainers want the ms dependency changed from ^2.1.1 to 2.1.1, and which supported release series should receive it. Then locate the package manifest's dependency entry, apply the agreed version constraint, and verify the resulting dependency metadata for the affected release.
Written by the indexing model from the issue text.
Description
Hello 👋 I wanted to open this issue to get a gauge on the single dependency the module has.
Currently this module as a dependency on ms with the semver range set to ^2.1.1.
This in itself is not bad. I know bumping dependency versions is annoying, as well.
I just wanted to check on if there would be strong disinterest in setting it to, like 2.1.1. The reason I'm even bothering to ask is because I love this module, and love using it. When I look at the modules in use, I look at the list of users who can affect the final install. When another package (package_a) takes a dependency on debug, even if it pins the version of debug it depends on (thus none of the debug publishers can affect package_a), all the current and future publishers of ms can still alter the final install of package_a, which means users of package_a must trust the author(s) of ms.
The ms module does not seem to change regularly, so that why I'm even bothering to propose this to get a gauge on the opinions here.
If it's agreeable, I can make a pull request with the change, even. I'd love to see it backported to the 3.x series (as it seems there have been backports according to npm info debug time), but if 3.x is dead now, then even just 4.x is cool.
Let me know what you think, and if you're "no" you won't hurt my feelings :)
- Dominant language
- JavaScript
- Stars
- 11.5k
- Forks
- 992
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from debug-js/debug
-
Difficulty 1/5 Under an hour Newbie friendliness 82/100
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
-
Debug as JSON Open
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
-
Difficulty 3/5 1-2 days Newbie friendliness 28/100
Similar issues
-
bot:ai-assisted component:compact-js status:untriaged
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
midnightntwrk/midnight-sdk#403 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
Difficulty 1/5 1-3 hours Newbie friendliness 86/100
DavidAnson/markdownlint-cli2#940 ·
-
documentation
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
githubnext/gh-aw-workshop#3692 ·
-
agent/guide documentation hive/hosted-available-lke648397-260827-5n31
Difficulty 2/5 1-3 hours Newbie friendliness 90/100