LOCK ME NOW 2 GITHUB INSTALL
LOCK ME NOW 2 GITHUB UPDATE
LOCK ME NOW 2 GITHUB PATCH

If you delete package-lock.json now from any one of your projects and run npm install again, it will most certainly look completely different. So even if you are using strict versions (without the ^), the libraries you are using do not. This also applies to transitive dependencies.Have a look at your package-lock.json and count how many dependencies with major version 0 you have.įor this blog (made with gatsby) I have 362! The public API SHOULD NOT be considered stable. Major version zero (0.y.z) is for initial development. Major version zero is exempt from the rules of semantic versioning.It trusts that everyone strictly adheres to semantic versioning, and I sincerely doubt that this is the case.This means no major changes, but minors and patches. So when you delete package-lock.json, all those consistency goes out the window.Įvery node_module you depend on will be updated to the latest version it is theoretically compatible with.

LOCK ME NOW 2 GITHUB PATCH

I would not want to ship a newer version to production than we tested with, even if it's just a patch version. This is important because it guarantees that every developer in the team will have the same version on their machine, and it is equally important for CI/CD. So if 4.2.1 is the latest version at the moment of your install, this version will be written to package-lock and will, from there on, always be installed.Įven if newer versions come out that are theoretically compatible with it. Upon installing, it will 'lock' you in on the version that you just installed. This is where package-lock.json comes into play. Which means 'compatible with version, according to semver'.Įnter, for example, lodash as the package and ^4.2.1 as version,Īnd you will see that you can get anything from 4.2.1 to 4.17.20 (the latest version) When you install a dependency for the first time, it is usually automatically added to your dependencies or devDependencies with ^version, Why you should never delete package-lock.json The conflicts in package.json are usually easily solved (if there even are any), so I think it is tempting to just delete package-lock.json and run npm install.Īfter all, this will give you a brand new package-lock.json, which you can happily commit. So here you are, updating your PR with the base branch, and git shows you this huge amount of conflicts in package-lock.json. The result of package-lock then changes, and whoever gets their PR merged to main first is the lucky one who avoided those conflicts.

LOCK ME NOW 2 GITHUB UPDATE

It usually happens when two branches add or update a dependency. One thing that can be costly when done wrong is solving conflicts in generated files, like package-lock.json. However, it is technically feasible, so I mention it here for completeness.I wish I wouldn't spend as much time solving git conflicts as I currently am. That's a lot of work for a very small pay-off, since you could get the same benefit with less work with a clone. For example, you might use semaphore files (such as those created by lockfile from the lockfile-progs package) or flock in a wrapper script that turns off write or execute permissions on your shared directory before kicking off some long-running build process. You could certainly design your own scripts to abuse the shared-repository model.

Abusing Shared Repositories with Semaphores There are certainly some use cases for the shared repository model. By definition, any shared repository can have the working directory modified by anyone with the necessary permissions, so you shouldn't be using a shared repository if you need to ensure a stable working directory during the lifetime of some process. Unless you are using a shared repository configured with core.sharedRepository enabled, you should be pushing to a bare repository and running any continuous integration or build systems off a non-bare clone. Some SCMs that support optional locks include SVN, CVS, and RCS. If you want an SCM with locking, use something else with a centralized-repository model.

Lock me now 2 github