Remove lockfile, add to gitignore, and add npmrc preventing its generation#26519
Conversation
|
I'm puzzled. How is one supposed to build an older version of TypeScript if one doesn't know which dependencies it worked with? Stuff changes in backwards incompatible ways all the time and having no record of working dependencies makes it impossible to build an older version. Occasionally it obviously impedes even building the latest version. I argue you should at least lock down major versions and hope for the best that everyone follows semver. |
Roll the malfunctioning deps backwards until they work, mostly. As I originally said in the PR OP: We only build against |
Our lockfile is unused in all our CI processes. It also shouldn't be used, since our goal is to always be built with our latest dependencies (hence the
latesttag on most of our dependencies). Lockfiles are more for reproducible builds usingnpm cifor end-user applications. It's presence frequently adds noise to PRs (where updates to it are frequently included by chance) and its presence is currently flagging the repo with a vulnerability warning because it contains a hard reference to an exact package version with a vulnerability, because it is not actually purposely maintained.