search

arb / celebrate

A joi validation middleware for Express.
MIT License
1.33k stars 66 forks source link

Bump version of @hapi/joi to 16.1.8 #159

Closed andrewoh531 closed 4 years ago

andrewoh531 commented 4 years ago

I noticed a change was made to @hapi/joi in version 16.1.8 which I want to utilize.

Would you be able to bump the version used internally in package-lock.json?

arb commented 4 years ago

I'd like to not have to publish a new version of celebrate every time joi is update. I specifically used joi 16.x.x in package.json to prevent this problem 🤔

Do you know if there is a way to have npm/yarn ignore a dependency when generating the lock file?

andrewoh531 commented 4 years ago

I'd like to not have to publish a new version of celebrate every time joi is update. I specifically used joi 16.x.x in package.json to prevent this problem 🤔

I think if you want to achieve that you should be listing joi as a peerDependency rather than a direct dependency.

This article explains quite well when you should use a peerDependency vs a regular dependency. Since joi isn't being used internally and IS being exposed by celebrate I think it makes sense for it to be a peerDependency.

Do you know if there is a way to have npm/yarn ignore a dependency when generating the lock file?

There are ways to override versions using resolutions in yarn but I don't believe there is an equivalent for npm, which unfortunately is what we're using.

arb commented 4 years ago

Have you tried removing your node_modules folder and re-installing your dependencies? package-lock.json isn't included in the tar when you install things from npm so I'd be surprised if it was having any effect here.

andrewoh531 commented 4 years ago

You're right that seems to be the case. I probably wasn't looking closely enough thanks!

And was going to ask you about @hapi/joi version 17 but looks like you're already on it! https://github.com/arb/celebrate/issues/162