LearnersGuild / idm

identity management service
MIT License
2 stars 24 forks source link

lock dependencies using `npm shrinkwrap --dev` #144

Closed jeffreywescott closed 7 years ago

jeffreywescott commented 8 years ago

Fixes #143.

Overview

First, we generated a npm-shrinkwrap.json file by running npm shrinkwrap --dev. Thanks to npm3, this file will be automatically updated every time dependencies are updated (e.g., either --save or --save-dev flags are passed on the npm install, npm upgrade, and npm uninstall commands).

Other Changes

Data Model / DB Schema Changes

N/A

Environment / Configuration Changes

Yes, run npm install

Notes

The way we're currently doing relative imports (i.e., adding a src symlink within node_modules) causes the shrinkwrap process to fail. So, before you install / upgrade / uninstall a dependency, you'll need to remove that symlink or the shrinkwrap process will fail and report an error. I've added a symlinks:remove npm script to make it easier, but it's still on us as developers to not ignore errors reported when changing dependencies.

Overall, this whole process makes me want to (re-)investigate: