Concerns of usage of >= for whatwg-fetch version in package.json?

matthew-andrews / isomorphic-fetch

Isomorphic WHATWG Fetch API, for Node & Browserify

MIT License

6.96k stars 290 forks source link

Concerns of usage of >= for whatwg-fetch version in package.json? #174

Closed msafari closed 3 years ago

msafari commented 5 years ago

I just noticed in our dependency tree that isomorphic-fetch started pulling v3.0.0 of whatwg-fetch. I believe it's because this repo is using >= 0.10.0 in package.json. Is there a reason you're not using just a caret to be safe and stay in the closest major version? >= will pull in latest major version. What if it's a breaking version that's being pulled in?

rafaellyra commented 5 years ago

It is in fact a problem right now since v3.0.0 is not working with webpack

gfx commented 5 years ago

ping @matthew-andrews

mbifulco commented 5 years ago

@matthew-andrews we would love some insight/help with this - it's been blocking some important updates for my team. Can you take a look at #177?

matthew-andrews commented 3 years ago

Hi sorry for the immense delay, I have updated to the latest versions of node-fetch and whatwg-fetch in master … and as part of that changed to ^ semver … … planning to release as a major version once I'm happy this hasn't broken anything … … …