81–90 of 478 posts
It's downloaded 11 million times a week. This touches a good majority of the Node ecosystem, so there's going to be quite a lot that doesn't work until this is remedied. And I'm not sure that package-lock.json is going to save folks here because it was a minor version update. https://www.npmjs.com/package/is-promise
There is something aggravating about the first comment in an issue like this posted minutes after the issue was created to say “is this fixed yet?”
return !!obj && (typeof obj === 'object' || typeof obj === 'function') && typeof obj.then === 'function'
Chill with the js hate, this happens everywhere. Maybe not to this extend, but if X (where X is whatever you are thinking about) had similar amount of people using it (especially junior people) this would happen there as well.
No, this does not happen everywhere. Show me this happening in Debian.
I hope that more packaging systems take the go modules approach and cryptographically and immutably identify their dependencies at time of addition to the project. This sort of breakage shouldn’t be possible.
I'm sorry if you were unaware, but they absolutely do that, and were doing that long before go was.
If deps are immutable, then nothing anyone does in any other package (short of having the package repository take the code down) should be able to break your future builds.
If that were true, TFA would not be news.
Chill with the js hate, this happens everywhere. Maybe not to this extend, but if X (where X is whatever you are thinking about) had similar amount of people using it (especially junior people) this would happen there as well.
Other languages don't publish/import packages that are one line of code. I have never seen an issue like this with any other language that I've worked with.
Any sane developer that needed a one-liner like this would just manually implement it.
Not to mention that these sorts of functions are unnecessary in languages with a good stdlib or statically typed languages like rust, etc.
Everyone crying about this on the Internet would do better to just take it as an easy lesson: pin your dependency versions for projects running in production. This was an honest oversight, and even somewhat inevitable with so many expected supported ways to import/export between cjs mjs amd umd etc. It will happen again. And when it happens the next time, if it ruins your life again, take issue with yourself for not…
Works for existing apps, but people using create-react-app and angular CLI can't even start a new project.
And the source code of the library is: function isPromise(obj) { return !!obj && (typeof obj === 'object' || typeof obj === 'function') && typeof obj.then === 'function'; }
Wow just wow. So here's your new Promise object: class World { then () { return 0; } } isPromise(new World) // true If there really isn't a safe and better way to tell if an object is an instance of Promise…then color me impressed.
Earlier quoted context omitted.
I'm sorry if you were unaware, but they absolutely do that, and were doing that long before go was.
I am aware of package lockfiles. If deps are immutable, then nothing anyone does in any other package (short of having the package repository take the code down) should be able to break your future builds. If that were true, TFA would not be news.