use overrides in package.json instead of force-resolutions #588
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
chschrae
approved these changes
Nov 2, 2022
BrianMouncer
reviewed
Nov 2, 2022
| @@ -116,10 +116,16 @@ | |||
| "uuid": "^8.3.0", | |||
| "ws": "^7.5.6" | |||
| }, | |||
| "resolutions": { | |||
| "overrides": { | |||
| "extend": "3.0.2", | |||
There was a problem hiding this comment.
is this just manually what "-force-resolution" use to do?
There was a problem hiding this comment.
Overrides allow a bit more granular control, where we can force a version when a dependency is a sub-dependency of a specific library. This link describes the override capability better than I can.
BrianMouncer
approved these changes
Nov 2, 2022
anantoghosh
reviewed
Nov 2, 2022
| @@ -94,7 +94,7 @@ | |||
| "lint": "eslint -c .eslintrc.js --ext .ts src", | |||
| "civersion": "node ci/version.js", | |||
| "prepare": "npm run build", | |||
| "preinstall": "npm install --package-lock-only --ignore-scripts --no-audit && npx npm-force-resolutions" | |||
| "preinstall": "npm install --package-lock-only --ignore-scripts --no-audit" | |||
There was a problem hiding this comment.
Please read #549 (comment)
Running npm install in the preinstall script here will run it when a user installs this package messing up their node_modules. This also does not work with yarn or pnpm.
Use an alternate script name like setup to allow your developers to run this script.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This should remove all vulnerabilities listed on npm install/npm run build and all build warnings related thereto.
Internal Ref ID 4404953