Should we just remove the yarn.lock file?

[bendog]

Since this is a package, should we just remove the yarn.lock file? In python world this wouldn't be included in a package codebase, and it only seems to get dependabot upset.

[lilfolr]

No. yarn.lock ensures the developers who work on this package are running the exact same dependencies. You running different minor versions to me is a recipe for disaster imo (especially in JS). Dependabot is complaining because we're using old, vulnerable libraries - the fix is updating, not ignoring 🙂

[bendog]

Seems legit. Should the package.json be updated with these version bumps too?

[lilfolr]

We probably should to keep things clean, but its not required for the version bumps.
In general you would only upgrade package.json, and let yarn sort out yarn.lock.

I don't think dependabot changed package.json because our package.json uses the ^ which allows for upgrading minor & patch versions - eg. See here

[bendog]

Yes, but should we be bumping the minimums versions?

[lilfolr]

Yeah, nothing wrong with staying up to date