Thoughts on locking version of "ms" dependency?

Aperta
#688 6 commenti 1 reazione 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
35/100
Tipo di issue
Refactoring
Chiarezza
Abbastanza chiara
Stato di attività
Ferma
Stack tecnologico
javascript
Ambito
tooling

Direzione di ricerca

First confirm whether maintainers want the ms dependency changed from ^2.1.1 to 2.1.1, and which supported release series should receive it. Then locate the package manifest's dependency entry, apply the agreed version constraint, and verify the resulting dependency metadata for the affected release.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

change-patch

Hello 👋 I wanted to open this issue to get a gauge on the single dependency the module has.

Currently this module as a dependency on ms with the semver range set to ^2.1.1.

This in itself is not bad. I know bumping dependency versions is annoying, as well.

I just wanted to check on if there would be strong disinterest in setting it to, like 2.1.1. The reason I'm even bothering to ask is because I love this module, and love using it. When I look at the modules in use, I look at the list of users who can affect the final install. When another package (package_a) takes a dependency on debug, even if it pins the version of debug it depends on (thus none of the debug publishers can affect package_a), all the current and future publishers of ms can still alter the final install of package_a, which means users of package_a must trust the author(s) of ms.

The ms module does not seem to change regularly, so that why I'm even bothering to propose this to get a gauge on the opinions here.

If it's agreeable, I can make a pull request with the change, even. I'd love to see it backported to the 3.x series (as it seems there have been backports according to npm info debug time), but if 3.x is dead now, then even just 4.x is cool.

Let me know what you think, and if you're "no" you won't hurt my feelings :)

Lingua principale
JavaScript
Stelle
11.5k
Fork
992
Nessuna PR unita negli ultimi 30g

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di debug-js/debug

Tutte le issue di debug-js/debug

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.