I checked package.json in that commit, and noticed that all the dependencies are specified using the caret, including "async":
"async": "^2.5.0"
So, since async got updated to 2.6, our package-lock.json got broken as well.
Solution
I'm not entirely sure what the best solution here is.
I wish there was a way to force npm to treat all dependency version numbers in all package.json files (and their dependencies) as fixed, specific versions. Then we wouldn't have this problem and we wouldn't have to change anything.
Maybe that's possible with the latest npm? I haven't checked.
The hard way is to manually clone and fix all dependencies we need. 😒
Problem
I just noticed that
package-lock.json
will get updated if any dependency of any dependency is not fully specified and gets updated.For example, on a clean
npm install
, I noticed this diff inpackage-lock.json
:I checked
package.json
in that commit, and noticed that all the dependencies are specified using the caret, including"async"
:So, since
async
got updated to 2.6, ourpackage-lock.json
got broken as well.Solution
I'm not entirely sure what the best solution here is.
I wish there was a way to force npm to treat all dependency version numbers in all
package.json
files (and their dependencies) as fixed, specific versions. Then we wouldn't have this problem and we wouldn't have to change anything.Maybe that's possible with the latest npm? I haven't checked.
The hard way is to manually clone and fix all dependencies we need. 😒