Re:Why is a Java guy so excited about Node.js and JavaScript?
by frankwallis on Tuesday August 28, 2018 @02:35PM
(#17861534)
This is untrue. If you need to update one dependency; npm/yarn will update the lockfile with the minimal changes needed to update that one dependency. You do not need to regenerate the entire lockfile.
Fixed the Javascript way, layers of workarounds.
And if you indeed need to update a dependency, you need to regenerate the lock.
But the main difference is that when that happens, the onus to verify all packages transitive unpinned dependencies still result in a working combination (of which there is no guarantee) is on the receiving developer, not on the package maintainer.