search

fossar / selfoss

multipurpose rss reader, live stream, mashup, aggregation web application
https://selfoss.aditu.de
GNU General Public License v3.0
2.38k stars 345 forks source link

Commit package-lock.json files to git #1160

Closed squatica closed 4 years ago

squatica commented 4 years ago

These files should be committed to git (even npm complains when installing: npm notice created a lockfile as package-lock.json. You should commit this file.). Otherwise you risk your users or co-devs installing different dependencies when a new package version was released. Committing the lock file makes the upgrade more controlled. The exact same version will be installed for everyone by npm install, and when you want to upgrade packages you will see changes in the lock file, which should again be committed.

jtojnar commented 4 years ago

We do have package-lock.json for the javascript client https://github.com/SSilence/selfoss/blob/master/assets/package-lock.json, the top-level package.json is just for npm-scripts. Though we now do depend on archiver, so I guess package-lock might be useful there as well.

jtojnar commented 4 years ago

Fixed in ab1e8b864ef11f16710e8d60a20c14681c5a5607.