Closed djordje closed 2 years ago
I do not see the package.json file being updated — which is really the one that matters. Can you verify?
@XVincentX It was package-lock.json
that has been updated. According to my understanding package doesn't lock versions since you have ^
. It's in "files changed" tab, but not visible since diff is big.
In such case, this PR is useless. The package-lock.json file does not get uploaded in the npm package anyway, so the user would not be able to see any difference.
I'm still willing to accept it, but I do see a number of new dependencies because of duplicated. Try to run npm dedupe
and see if the size gets reduced.
In such case, this PR is useless. The package-lock.json file does not get uploaded in the npm package anyway, so the user would not be able to see any difference.
I'm still willing to accept it, but I do see a number of new dependencies because of duplicated. Try to run
npm dedupe
and see if the size gets reduced.
You're actually right. Lock doesn't get to the registry... Might be better to start fixing versions in package file. Main issue I have might be collision between express-gateway and other packages dependencies. I'll try to track it down.
BTW dedupe
is done.
Used following procedure:
npm outdated
- check outdated and audit datanpm update
- to update to newest version satisfying package filenpm audit
- there are two minor reports, but medium, high and critical reports have been fixed