From 1dc1fc4a3c6db8bb3847402fe08c880d704f4d73 Mon Sep 17 00:00:00 2001 From: Daniel Holbach Date: Fri, 7 Jun 2019 10:54:38 +0200 Subject: [PATCH] Created Updating JS dependencies (markdown) --- Updating-JS-dependencies.md | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 Updating-JS-dependencies.md diff --git a/Updating-JS-dependencies.md b/Updating-JS-dependencies.md new file mode 100644 index 0000000..0771226 --- /dev/null +++ b/Updating-JS-dependencies.md @@ -0,0 +1,11 @@ +Sometimes security problems (or other reasons) make it necessary to update Javascript dependencies. In general it's a good idea to follow this process: + +- `yarn why ` (tells us what is pulling `pkg` in) +- `yarn info ` (figure out which versions are available) +- consult `package.json`, try updating the version +- run `yarn install && yarn test` +- verify in `git diff` if all occurrences in `yarn.lock` were updated + +Sometimes an old leaf package is pulled in through a bit which hasn't updated its pinned dependencies in a while, so an old version is still pulled in. + +Using [`nvm`](https://github.com/nvm-sh/nvm) to get the right version of node can help too. \ No newline at end of file