diff --git a/website/docs/dependency-pinning.md b/website/docs/dependency-pinning.md index 4635f38f6c09fc7abe2ebee943cc98fc429d8948..2b6387b06a8ad8de69c42706aed24ee240d07269 100644 --- a/website/docs/dependency-pinning.md +++ b/website/docs/dependency-pinning.md @@ -119,7 +119,7 @@ The upside is that the lockfile will hold back `foobar` to `1.1.0` unless it's f The easiest case is if for some reason you _need_ to upgrade `foobar`, e.g. for a new feature it contains, so you might run something like `yarn upgrade foobar`. Then you might either discover the break during your development or when you push your new development to CI for testing. In this case, hopefully you'll guess it's `foobar` that broke it and not your own code. -Alternatively, maybe someone thinks "This lockfile is probably really out of date and might be missing some essential patches" and decides to `yarn upgrade` the whole thing in one go. No doubt the diff will be full of green and red as many direct and indirect dependencies will have changed versions. Then it's pushed to CI for testing, fails, and you have to guess which of the changes caused it until you eventually narrow it down to `foobar`. This might require even manually looking through the lock file diffs line by line. Maybe dep `blahblah` also broke at teh same time, to make it even harder. +Alternatively, maybe someone thinks "This lockfile is probably really out of date and might be missing some essential patches" and decides to `yarn upgrade` the whole thing in one go. No doubt the diff will be full of green and red as many direct and indirect dependencies will have changed versions. Then it's pushed to CI for testing, fails, and you have to guess which of the changes caused it until you eventually narrow it down to `foobar`. This might require even manually looking through the lock file diffs line by line. Maybe dep `blahblah` also broke at the same time, to make it even harder. By ceding control of direct dependency versions to the lock file, you have lost the ability to _know_ when things are updated. You also may be missing out on really important patches you're not even aware of, because they're "in range" yet locked back to vulnerable or buggy versions in the lock file.