Builds Today; Breaks Tomorrow: The Mystery of the Disappearing NPM Dependency
summary
On April 28 2021 several Gatsby builds (developer.js.com and an internal docs site) fail because a transitive package smart-wrap (GPLv2) suddenly appears when graphql-tools-schema upgrades to 7.1.4 which adds value-or-promise that depends on smart-wrap; nothing in direct deps changed. Recommended fixes are to commit lock files, run npm ci in CI, or short-term pin to 7.1.3; the maintainer resolves it by moving change-set-cli to a devDependency, and the fix reaches npm within two days.
AI-written summary · about
chapters (15)
- 0:00Hi! I'm Bella Wiseman
- 2:03How Goldman Sachs Uses GatsbyJS
- 3:04Open Source Licenses
- 4:54Dependency Tree
- 5:24What Changed? Nothing!
- 6:20NPM Versioning
- 10:49Mystery solved!
- 11:46Don't be taken by surprise
- 12:18Lock files!
- 13:01Use npm ci in your builds
- 13:53A Comparison
- 16:25Fix the underlying issue
- 18:30Package Maintenance Best Practices
- 19:34About Goldman Sachs Engineering
- 20:16Questions?
related talks
41mThe Future of JavaScript Package Management
23mUntangling Your Dependencies: A Pattern for a Well-Knit JavaScript Project
16mDependency Hell Just Froze Over
38mDependency Management: The Cause of—and Solution to—All Supply...
27mnpm i g @next and beyond: Building the future of package management
20mUntangling Your Dependencies: A Pattern for a Well-Knit JavaScript Project
42mSecuring Your Software Supply Chain
45mNext Gen Package Management