Hmm, I had some problems with a nested `is-object` dependency when updating some deps last week, I wonder if it’s related.
A one-line package broke `npm create-react-app`
11–20 of 478 posts
Re: A one-line package broke `npm create-react-app`
#12This is why regression suites are important. EDIT: I wasn't dissing the developers. They have regression, this was just an accident. I was stating it is important. My bad (too late to delete).
Install any moderately complex nodejs lib or app and it will throw tons of warnings, ignored errors, and security issue alerts. As you should with any app running in production, lock down everything and watch network traffic because there are innumerable backdoors in the JavaScript ecosystem.
Re: A one-line package broke `npm create-react-app`
#13Earlier quoted context omitted.
The package does have CI setup, however the test matrix does not cover the latest node versions (which are the ones that are affected). See https://github.com/then/is-promise/blob/master/.travis.yml (missing v11, v12, v13, v14)
And CI is failing[0]. [0]: https://travis-ci.org/github/then/is-promise/builds
The failing CI here is unrelated to the issue but it's still pretty bad a release was made with failing CI.
Re: A one-line package broke `npm create-react-app`
#14The package referred to in the clickbait title is `is-promise`
I don't know how "clickbait" that title can be when it is, in fact, longer than the line of code in question: declare function isPromise (obj: Promise | S): obj is Promise ; This is, indeed, the only line of exported code in the entire package. I genuinely don't understand the NPM world.
That's just the type definition. Think of it like the .h if you're into that sort of thing.
Re: A one-line package broke `npm create-react-app`
#15The package referred to in the clickbait title is `is-promise`
Does the package name need to be in the title if it's already the URL? :)
Re: A one-line package broke `npm create-react-app`
#16The javascript ecosystem is a total house of cards, "webshit" as they call it in some other sites, rings true more and more.
Re: A one-line package broke `npm create-react-app`
#17The package referred to in the clickbait title is `is-promise`
I don't know how "clickbait" that title can be when it is, in fact, longer than the line of code in question: declare function isPromise (obj: Promise | S): obj is Promise ; This is, indeed, the only line of exported code in the entire package. I genuinely don't understand the NPM world.
Me neither. I can't wait for Deno 1.0 next month.
Re: A one-line package broke `npm create-react-app`
#18The package referred to in the clickbait title is `is-promise`
I don't know how "clickbait" that title can be when it is, in fact, longer than the line of code in question: declare function isPromise (obj: Promise | S): obj is Promise ; This is, indeed, the only line of exported code in the entire package. I genuinely don't understand the NPM world.
> I genuinely don't understand the NPM world.
You're right, you don't. What you posted is just the function declaration, not the implementation.
Re: A one-line package broke `npm create-react-app`
#19The package referred to in the clickbait title is `is-promise`
I don't know how "clickbait" that title can be when it is, in fact, longer than the line of code in question: declare function isPromise (obj: Promise | S): obj is Promise ; This is, indeed, the only line of exported code in the entire package. I genuinely don't understand the NPM world.
I think it reflects how the evolution of the JS ecosystem strongly resembles natural evolution. This package is now a vestigial organ, but there was a time when it served a useful purpose. Other packages formed connective tissue to this package, and since those package may still be useful, this one has stuck around.
Re: A one-line package broke `npm create-react-app`
#20This is why regression suites are important. EDIT: I wasn't dissing the developers. They have regression, this was just an accident. I was stating it is important. My bad (too late to delete).
Could create-react-app have avoided this through regression suites?