About ua-parser-js

[LeviticusMB]

So yesterday evening, I decided to bump the deps in a project of mine. Checked with pnpm outdated -r first, then pnpm upgrade -r.

After this, I had two versions of ua-parser-js in node_modules/.pnpm: [email protected] and [email protected]. But since pnpm outdated -r also listed version 1.0.1 as the latest version, I decided to check out what was new and quickly discovered faisalman/ua-parser-js#536.

Had I run the upgrade command just a few hours earlier, well ... then what? What would have happened?

1. How is pnpm protecting me from a game over scenario when running pnpm upgrade?
2. What can I do myself to ensure nothing bad happens in this case?

[zkochan]

I am not sure what we can do on our side. Maybe allow new versions with a delay? So only upgrade to a version if it was released 24 hours ago?

[zkochan]

Kind of a related discussion: #3881

I think it would make sense to more prominently display the publisher's identity.

[LeviticusMB]

Just wanted to say that I'm really happy that onlyBuiltDependencies now exists, and that it even defaults to nothing in v10! Awesome.

I still think that the grace period is a good idea though. And the 2FA warning.

[zkochan]

Good, looks like there is a loud angry minority that is not happy with the change. Had to lock a few discussions already.

[LeviticusMB]

And now #9921! 💯