wesaynih / infrastructure

© 2016 The Knights Who Say NIH — Do NOT fork this repository without permission.
http://frameless.io/
Other
0 stars 1 forks source link

Check usage of the latest versions of npm packages #25

Closed Robbert closed 8 years ago

Robbert commented 8 years ago

When vulnerabilities in packages are found and resolved, it is important to stay up to date. For devDependencies therefore I think it is safe and important to use the latest version of packages. By default npm install --save-dev stores the package in the format "^0.0.0" but this allows only updates of minor fixes (0.0.10.0.2), while backwards compatible upgrades (from 0.0.10.1.0) are ignored. While for production usage it is important to be absolutely sure a version of any given package works exactly as intended, for development it is okay if something breaks -- that way we catch these issues early on.

Therefore I propose using the "^0.0" version pattern for devDependencies and use the exact 0.0.0 version number pattern for dependencies.

This would also prevent a very frequent "packages out of date" status badge.

Robbert commented 8 years ago

I have set up a free account with Gemnasium to provide us with a nice badge:

Dependency Status

Since we don't have any dependencies as of yet, I have checked the "Use development dependencies badge" under Settings > Badges.

Robbert commented 8 years ago