Thoughts on locking version of "ms" dependency?

Abierto
#688 6 comentarios 1 reacción 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
35/100
Tipo de issue
Refactorización
Claridad
Bastante claro
Estado de actividad
Estancado
Stack tecnológico
javascript
Área
tooling

Línea de trabajo

First confirm whether maintainers want the ms dependency changed from ^2.1.1 to 2.1.1, and which supported release series should receive it. Then locate the package manifest's dependency entry, apply the agreed version constraint, and verify the resulting dependency metadata for the affected release.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

change-patch

Hello 👋 I wanted to open this issue to get a gauge on the single dependency the module has.

Currently this module as a dependency on ms with the semver range set to ^2.1.1.

This in itself is not bad. I know bumping dependency versions is annoying, as well.

I just wanted to check on if there would be strong disinterest in setting it to, like 2.1.1. The reason I'm even bothering to ask is because I love this module, and love using it. When I look at the modules in use, I look at the list of users who can affect the final install. When another package (package_a) takes a dependency on debug, even if it pins the version of debug it depends on (thus none of the debug publishers can affect package_a), all the current and future publishers of ms can still alter the final install of package_a, which means users of package_a must trust the author(s) of ms.

The ms module does not seem to change regularly, so that why I'm even bothering to propose this to get a gauge on the opinions here.

If it's agreeable, I can make a pull request with the change, even. I'd love to see it backported to the 3.x series (as it seems there have been backports according to npm info debug time), but if 3.x is dead now, then even just 4.x is cool.

Let me know what you think, and if you're "no" you won't hurt my feelings :)

Lenguaje dominante
JavaScript
Estrellas
11.5k
Forks
992
Sin PR fusionados en 30 d

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de debug-js/debug

Todos los issues de debug-js/debug

Issues similares

Más issues de JavaScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.