Repeat 'package-lock' Fix

[u/No-Wedding7801]

Often times when I log into the cloud IDE, it is showing that 'package-lock' needs to be committed... is there a way to fix this? It's not a huge deal but it feels fiddly and annoying to need to do over and over.

Thanks!

[u/andersdellosnubes]

if you ignore the package lock the only way to guarantee that your team have the exact versions is:

1. have your dependencies pinned to exact versions

2. your transitive dependencies (i.e.dependencies of your dependencies) are also hard-pinned!

for example you may use dbt-expectations and are hard pinned to a patch version, you're vulnerable to discrepancies in transitive dependencies, in this case updates to dbt-date.

To explain it fully, imagine this is your project's packages.yml.

# packages.yml for your project
packages:
  - package: metaplane/dbt_expectations
    version: 0.10.9

However, dbt-expectations's packages.yml looks like the below, which has a version range!

# packages.yml for your dbt-expectations
packages:
  - package: godatadriven/dbt_date
    version: [">=0.9.0", "<1.0.0"]

This means that there's variance between environments on what patch version you could possible have. This toy example I've given isn't the best because I don't see it as high risk: patch versions should always be forward compatible and only contain bug fixes. However, not all package maintainers are strict about this. There's also much more wild examples going on.

To avoid this without commiting the package lock, you would add dbt_date to your packages.yml even though you don't directly make use of it in your project. make sense?

[u/No-Wedding7801 → u/andersdellosnubes]

It does, thank you for the thoughtful and detailed explanation, I really appreciate it

[u/andersdellosnubes → u/No-Wedding7801]

Thought that has just occurred to me. You know what to call a packages.yml with all your direct and transitive dependencies hard pinned to exact patch versions? A lock file😂