Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

package.json allow only git dependencies with commit hash #8

Open
AuHau opened this issue Mar 18, 2020 · 1 comment
Open

package.json allow only git dependencies with commit hash #8

AuHau opened this issue Mar 18, 2020 · 1 comment
Labels
sec: linting

Comments

@AuHau
Copy link
Owner

AuHau commented Mar 18, 2020

When you add Git repo as a dependency it will grab always the latest commit, which makes it unpredictable because two developers can use different version of the dependency.

It is possible to "stabilize" this situation using either tag version or commit hash which specifies exact point of the dependency's history that will be always installed. I would like to enforce this stability.
@AuHau
Copy link
Owner Author

AuHau commented Mar 18, 2020

Related to tclindner/npm-package-json-lint#220

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
sec: linting
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@AuHau