Skip to content

Conversation

dsherret
Copy link
Member

@dsherret dsherret commented Sep 3, 2025

Bans using npm/jsr imports without specifying a version requirement.

It's bad to not specify a version requirement because without a lockfile Deno will always pull in the latest version of a package, which could cause your code to stop working if the package ever publishes a breaking change.

@dsherret dsherret added this to the 2.5.0 milestone Sep 3, 2025
@dsherret dsherret requested a review from bartlomieju September 3, 2025 19:19
@dsherret dsherret enabled auto-merge (squash) September 3, 2025 19:19
@dsherret dsherret merged commit c4da264 into denoland:main Sep 3, 2025
19 checks passed
@knotbin
Copy link

knotbin commented Sep 14, 2025

This doesn't just apply to non-versioned specifiers. It applies to all bare specifiers, even if they specify a version.

If this is the case we need something like devDependencies to distinguish between dependencies needed for the program and ones needed for tests, benches, etc.

@dsherret
Copy link
Member Author

It applies to all bare specifiers, even if they specify a version.

Can you open an issue? This is a closed PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants