Pin npm-installed dependency versions

jonathanolson commented 9 years ago

Right now, npm installing at different times will change how our build process works, and may cause changes in how sims are built.

We should figure out a way of using https://docs.npmjs.com/cli/shrinkwrap so that this does not happen.

As noted in Skype:

I just "npm installed", and I got grunt 0.4.5 (published May 2014) which itself got eventemitter 0.4.14 (published June 2014), BECAUSE grunt's package.json has "eventemitter2": "~0.4.13", (0.4.13 was published August 2013). This still occurs if I force "grunt": "0.4.5" instead of "grunt": "~0.4.1".

jonathanolson commented 8 years ago

Recommend raising priority here, see https://github.com/phetsims/yotta/issues/17#issuecomment-180716501 (can't build some older currently published sim SHAs since we don't know what require.js versions we used to build then).

samreid commented 8 years ago

Today we discussed putting this back on our radar, to have @samreid and @jonathanolson work on in a couple of weeks.

samreid commented 7 years ago

This seems to be exactly what package-lock.json was designed for. We should look into this for chipper 2.0

samreid commented 1 year ago

Comments from https://github.com/phetsims/chipper/issues/1362

Today @marlitas and I investigated https://github.com/phetsims/chipper/issues/1361 and were shocked to discover that npm prune and npm install gave a very different version (4.7.4) than rm -rf node_modules and npm install (4.9.3). This led to a major difference in behavior in https://github.com/phetsims/chipper/issues/1361 and we would like to discuss how to get consistent versions across our project.

We did not understand why we aren't using package-lock.json, as discussed in https://github.com/phetsims/chipper/issues/578. We also discussed removing all the tildes and carets from package.jsons to protect against this in the future (even though it would probably be prohibitively expensive to do that for maintenance shas.)

We also observed that Deno supports npm specifiers like tilde and caret, so this problem wouldn't "go away" by just moving to Deno. https://deno.land/manual@v1.28.2/node/npm_specifiers

Tagging @jonathanolson since he helped discover #1361.

jonathanolson commented 1 year ago

Running npm install with package-lock enabled seems to modify that file AND package.json. Our tooling is set up to have npm operations NOT interfere with git/build/other operations.

Having something that pins exact dependencies sounds great (or possibly ways of supporting security fixes), but package-lock didn't seem to fulfill those requirements that well AND caused other breakage.

chrisklus commented 1 year ago

From 12/8/22 dev meeting:

@zepumph is going to replace all instances of the possibility of updating minor versions with the possibility of updating maintenance versions only. Thanks!

zepumph commented 1 year ago

@jonathanolson can you please look at both commits. I'm happy that I separated these our so that you can look at all the previously pinned versions that now accept maintenance updates. Anything else here?

We decided at dev meeting discussion that this was not worthy of a maintenance release. @jonathanolson is that right? Do you want to just throw this in to the one you are currently working on? ("throw" obvious demonstrating that I have no idea how in depth MR patching is).

jonathanolson commented 1 year ago

Looks good to me!

I think this should probably be tossed into the next maintenance release, tagging for that.

zepumph commented 1 year ago

Although @jonathanolson and I were excited to punt on this until next MR, but were running into https://github.com/phetsims/perennial/issues/293 because of the shared cache update for Puppeteer 19. Thus we need to proceed with this now.

zepumph commented 1 year ago

Please note that @jonathanolson and I ran into trouble here yesterday in a case where eslint was already on a high minor version, so changing from ^ -> ~ didn't change things, but for eslint-plugin-react, there were many minor versions ahead of where the version currently was (^7.18), so we needed https://github.com/phetsims/chipper/commit/cf881cc454cdde4f4df2a99bf9fbbe04a9d80359 where we set the version to ~7.31)

We saw another one of those in SOM 1.2 last night where we most likely want to update html-webpack-plugin from "~5.3.2" -> "~5.5.0". UPDATE: This was a translation build that wasn't using these changes, ignore this.

jonathanolson commented 1 year ago

acid-base-solutions 1.2 (https://github.com/phetsims/chipper/issues/114)