Dependency & Node version pinning #573
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Story
Description
There are no functional changes being introduced by this PR.
Because of build-time introduced by v8.15.0 of the
ajvdep (see this issue), our semver spec for this dep was allowing this newer version to be used when installing nodeCf.This PR explicitly pins all of the deps according to the version that was in effect the last time
package-lock.jsonwas updated. That's why you don't see any dep version changes inpackage-lock.jsonin this PR.Also included in this PR are a
.nvmrcto be more explicit about the version of Node that's used to build/publish this package (sourced from TeamCity and up-versioned to be the latest patch level).Finally, the minor number is being bumped to represent dep version explicitness.
We will be simul-deploying to both Sinopia (private, hosted repo) and GitHub Packages until we've migrated all projects to use GitHub Packages.