Update dependencies - Githubissues

ExpressGateway / express-gateway

A microservices API Gateway built on top of Express.js

https://www.express-gateway.io

Apache License 2.0

2.96k stars 344 forks source link

Update dependencies #1024

Closed djordje closed 2 years ago

djordje commented 3 years ago

Used following procedure:

npm outdated - check outdated and audit data
npm update- to update to newest version satisfying package file
npm audit - there are two minor reports, but medium, high and critical reports have been fixed

XVincentX commented 3 years ago

I do not see the package.json file being updated — which is really the one that matters. Can you verify?

djordje commented 3 years ago

@XVincentX It was package-lock.json that has been updated. According to my understanding package doesn't lock versions since you have ^. It's in "files changed" tab, but not visible since diff is big.

XVincentX commented 3 years ago

In such case, this PR is useless. The package-lock.json file does not get uploaded in the npm package anyway, so the user would not be able to see any difference.

I'm still willing to accept it, but I do see a number of new dependencies because of duplicated. Try to run npm dedupe and see if the size gets reduced.

djordje commented 3 years ago

In such case, this PR is useless. The package-lock.json file does not get uploaded in the npm package anyway, so the user would not be able to see any difference.

I'm still willing to accept it, but I do see a number of new dependencies because of duplicated. Try to run npm dedupe and see if the size gets reduced.

You're actually right. Lock doesn't get to the registry... Might be better to start fixing versions in package file. Main issue I have might be collision between express-gateway and other packages dependencies. I'll try to track it down.

BTW dedupe is done.