Background
In order to harden our project, it is advised to pin our dependency versions without carets or tildes. Our package.json files currently use the ^ range specifier. Pinning to exact versions makes every dependency change a deliberate, reviewable commit. It is also advised to use Dependabot. We only use that to handle Github Action updates, we should cover npm as well.
What to do
- Pin all versions in all
package.json files.
- Add an npm ecosystem block to
.github/dependabot.yml
Acceptance criteria
- package.json contains no ^ or ~ version prefixes
- .github/dependabot.yml has an npm ecosystem entry
- CI passes on a clean install
Background
In order to harden our project, it is advised to pin our dependency versions without carets or tildes. Our
package.jsonfiles currently use the^range specifier. Pinning to exact versions makes every dependency change a deliberate, reviewable commit. It is also advised to use Dependabot. We only use that to handle Github Action updates, we should cover npm as well.What to do
package.jsonfiles..github/dependabot.ymlAcceptance criteria