Closed Robbert closed 8 years ago
I have set up a free account with Gemnasium to provide us with a nice badge:
Since we don't have any dependencies
as of yet, I have checked the "Use development dependencies badge" under Settings > Badges.
package.json
to allow backwards-compatible updates.
When vulnerabilities in packages are found and resolved, it is important to stay up to date. For
devDependencies
therefore I think it is safe and important to use the latest version of packages. By defaultnpm install --save-dev
stores the package in the format"^0.0.0"
but this allows only updates of minor fixes (0.0.1
→0.0.2
), while backwards compatible upgrades (from0.0.1
→0.1.0
) are ignored. While for production usage it is important to be absolutely sure a version of any given package works exactly as intended, for development it is okay if something breaks -- that way we catch these issues early on.Therefore I propose using the
"^0.0"
version pattern fordevDependencies
and use the exact0.0.0
version number pattern fordependencies
.This would also prevent a very frequent "packages out of date" status badge.