Re:Node v8.1.2
by workerIbe on Thursday June 15, 2017 @10:03AM
(#14560453)
Definitely something to the addage "if it ain't broke don't fix it". Some of our less critical modules are set to latest others are updated with care. Our modules are not under source control so are refreshed on deployment. We use Snyk to monitor for vulnerabilities, works pretty well.
[ Parent
| on HN ]
Are you at least checking in your npm-shrinkwrap.json? (If not you've got pain waiting to happen, that you won't find out about until deploy time)!
Re:Node v8.1.2
by rubber_duck on Thursday June 15, 2017 @11:12AM
(#14561100)
This so much - shrinkwrap before it bites you when a CI kicks off a deploy that fails because it pulled latest minor dep release that broke everything (happened even in big lib like Angular 2 for us after stable 2.2 !) while your local box is running fine with a cached older version.
Re:Node v8.1.2
by kevinmannix on Thursday June 15, 2017 @11:16AM
(#14561153)
Yes. I've had an app break due to a dependency's dependency update. Was the night before a big product launch. Learned to rely on npm-shrinkwrap the hard way.