-
Notifications
You must be signed in to change notification settings - Fork 724
Open
Description
While looking into Component Governance alerts for this repository, I noticed that
- Dependencies are locked to specific versions, which makes bumping packages harder.
- Some dependencies such as telemetry-extractor are years out of date.
- yarn upgrade X does nothing, probably because of 1.
I suggest migrating to npm and using ^ along with the version numbers so that most CG alerts can be resolved with npm audit fix or dependabot.
Reactions are currently unavailable