fix: unpin dependencies, mark axe-core as peer

noahnu commented 2 years ago

Changes

Use lodash instead of lodash.merge. lodash is a common dependency and so it's very likely the consumer has it loaded as a transitive dependency of another package at a minimum, so this doesn't consume more disk space. lodash is more popular than lodash.merge.
Unpin dependencies. All the listed dependencies respect semver. It should be up to the package manager + consumer to decide which versions to satisfy jest-axe with, as long as semver is respected. This lets consumers patch security vulnerabilities easily.
Mark axe-core as a peer dependency (in addition to dependency). This lets a consumer override the version of axe-core being used. At least in Yarn Modern, if the peer is not provided, it'll fallback to the direct dependency.

@nickcolley If you're open to it, I have some other improvements/general maintenance I can put up PRs for. I can keep the PRs small and focused if you'd like. Right now the TypeScript types live in DefinitelyTyped. Would you be open to a PR which migrates this project to TypeScript? and if not that, what about maintaining the types in this repository in a separate declaration file?

NickColley commented 2 years ago

The only proposal I that I will consider is the Peer Dependency, is this something that impacts only Yarn users though?

noahnu commented 2 years ago

It might impact pnpm as well, I'm not sure since I don't use pnpm. I imagine it prints warnings in npm. Definitely impacts Yarn though.

I can revert the lodash change, it was a bit opportunistic. What's the reasoning behind pinning the dependencies though?

NickColley commented 2 years ago

Sorry I failed to mention that. axe-core can change it's output and break builds even with semver so that definitely needs to be pinned. I think when I did that I just did a blanket pin to make builds more deterministic but I'd be open to changing the others if you think the value is there just not axe-core.

noahnu commented 2 years ago

I reverted the axe-core semver change and reverted the switch to the general lodash package.

noahnu commented 2 years ago

I noticed axe-core requires node >12, so jest-axe's min node version could probably be raised

NickColley commented 2 years ago

Updated dependencies recently, keeping it simple for now.

NickColley / jest-axe

fix: unpin dependencies, mark axe-core as peer #223

Changes