Breaking changes with *npm*@3.5.0? #10612

Activity

1. Martii

   added a commit that references this issue on Nov 30, 2015

   Some dep updates and a doc CONTRIBUTING.md change

   ...

   3251795
2. trusktr commented on Dec 1, 2015

   

   trusktr

   on Dec 1, 2015

   More actions

   What do these warnings mean?
3. othiym23

   added

   support

   on Dec 1, 2015
4. othiym23 commented on Dec 1, 2015

   

   othiym23

   on Dec 1, 2015

   Contributor

   More actions

   Most of them are spurious warnings in npm@3.5.0, which is something fixed in npm@3.5.1, currently the next release. This isn't a breaking change, and in fact is addressing a long-standing bug in npm: previously, it was possible for the bundleDependencies included in a package tarball to be invalid with respect to the semver ranges declared in that package's package.json. The change to which this warning is attached is that npm will now fix those invalid dependencies.

   Unfortunately, due to a misplaced conditional and message, it prints out far more commonly than it should. If you want to see the actual number of times this warning is displayed, run npm -g install npm@next and try your install again. You should see many fewer of these warnings, or none at all.
5. othiym23

   closed this as completedon Dec 1, 2015
6. Martii commented on Dec 1, 2015

   

   Martii

   on Dec 1, 2015

   Author

   More actions

   @othiym23

   Most of them are spurious warnings in npm@3.5.0, which is something fixed in npm@3.5.1,

   That's great news and I greatly appreciate the citations... however it still appears that npm@3.5.1 is downgrading a dependency or two... for example the one below has a sub-tree of:

   (clipped for brevity)

   ├─┬ less-middleware@2.0.1 
   │ ├─┬ less@2.4.0 
   │ │ ├─┬ errno@0.1.4 
   │ │ │ └── prr@0.0.0 
   │ │ ├── graceful-fs@3.0.8 
   │ │ ├── image-size@0.3.5 
   │ │ ├─┬ promise@6.1.0 
   │ │ │ └── asap@1.0.0 
   │ │ └─┬ source-map@0.2.0 
   │ │   └── amdefine@1.0.0 
   │ ├─┬ mkdirp@0.5.1 
   │ │ └── minimist@0.0.8 
   │ └─┬ node.extend@1.1.5 
   │   └── is@3.1.0 

   ... as reported at less/less.js#2739 . If I'm not mistaken less.js-middleware is asking for 2.5.0 and npm is giving it 2.4.0 ... the same goes with downgrading source-map in less to an older release. These are also not on bundledDependencies but on dependencies and optionalDependencies respectively.

   Thank you for taking the time to see if this is a bug which I believe that it still may be... and at the very least extremely confusing to the node community by displaying source-map@0.2.0 and definitely installing less@2.4.0.
7. Martii commented on Dec 1, 2015

   

   Martii

   on Dec 1, 2015

   Author

   More actions

   Here's a spotlight screen cap of the manual confirmation that npm@3.5.1 did in fact download less@2.4.0 :

   

   ... so shouldn't this be still open?

   Why wouldn't npm be honoring semver with the requested less@2.5.0 (tilde included)?

   ---

   ~1.2.3 := >=1.2.3 <1.(2+1).0 := >=1.2.3 <1.3.0

   ... translated to that middlewares request...

   ~2.5.0 := >=2.5.0 <2.(5+1).0 := >=2.5.0 <2.6.0

   ... in which 2.4.0 doesn't fall within this range...

   ... and is the logic of semver as quoted from npmjs.com and semver directly as:

   Minor version Y (x.Y.z | x > 0) MUST be incremented if new, backwards compatible functionality is introduced to the public API. It MUST be incremented if any public API functionality is marked as deprecated. It MAY be incremented if substantial new functionality or improvements are introduced within the private code. It MAY include patch level changes. Patch version MUST be reset to 0 when minor version is incremented.

   Did we all miss something with the decrements that npm@3.5.0 and npm@3.5.1 appears to be doing now?
8. ChALkeR commented on Dec 1, 2015

   

   ChALkeR

   on Dec 1, 2015

   Contributor

   More actions

   If I'm not mistaken less.js-middleware is asking for 2.5.0 and npm is giving it 2.4.0

   You are mistaken. You are installing less-middleware@2.0.1 but are referencing to the package.json in the master branch. The correct file would be: https://github.com/emberfeather/less.js-middleware/blob/2.0.1/package.json#L12 (note the 2.0.1 tag).

   There were no less-middleware releases with the bumped dependency.
   This has nothing to do with npm, everything is correct from the npm side.
9. Martii commented on Dec 1, 2015

   

   Martii

   on Dec 1, 2015

   Author

   More actions

   You are installing less-middleware@2.0.1 but are referencing to the package.json in the master branch.

   I usually reference the latest commit... it appears that emberfeather/less.js-middleware#137 is open. I appreciate the additional check... would be nice if everyone did dep updates a little more often... and stated "working on next version". (if they are using that style)

   Thanks and officially closed from our end for now.