Skip to content

Lock beta js dependencies to a specific version

Tristan Read requested to merge tr-lock-vue-jest-version into master

What does this MR do?

When we depend on a beta version of a npm dependency, we should lock it to a specific version to avoid unintended side effects from upgrades. There is no guarantee that a beta version change will be safe from breaking changes.

This change locks vue/test-utils and vue-jest to specific beta versions. The current versions match the 'resolved' field of those dependencies in the yarn.lock file.

After this change, it should (in theory) be safe to refresh all our yarn dependencies.

Backstory

As part of updating a dependency !38536 (merged), the yarn.lock file was regenerated from the package.json. Normally this would be relatively safe, but in this case it caused a build failure.

This line in the build output indicates a possible cause of the failure:

warning " > vue-jest@4.0.0-beta.5" has incorrect peer dependency "jest@^25.x".

Screenshots

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [n/a] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [n/a] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [n/a] Security reports checked/validated by a reviewer from the AppSec team
Edited by Tristan Read

Merge request reports