Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updated locked dependencies #1257

Closed
cpswan opened this issue Aug 8, 2024 · 0 comments · Fixed by #1279
Closed

Updated locked dependencies #1257

cpswan opened this issue Aug 8, 2024 · 0 comments · Fixed by #1279
Assignees
Labels
enhancement New feature or request

Comments

@cpswan
Copy link
Member

cpswan commented Aug 8, 2024

Is your feature request related to a problem? Please describe.

As sshnoports and sshnp_flutter are not published packages we include pubspec.lock in this repo, which reflects a snapshot in time for the transitive dependencies.

Dependabot should alert us to any security vulnerabilities for specific versions in pubspec.lock, but will not propose changes to pubspec.yaml where we use ^ (which we do a lot).

This became problematic (#1246) with pinenacl 0.5.1 not working with Dart 3.5.0. The unit tests against noports_core were fixed with an upstream bump (atsign-foundation/dartssh2#3) to 0.6.0 but there were residual problems with pubspec.lock in sshnoports remaining pinned to 0.5.1

Describe the solution you'd like

Bump pubspec.lock files with dart pub upgrade and introduce a process to periodically review and test changes to transitive dependencies.

Describe alternatives you've considered

If we stop using ^ in the pubspec.yaml then we'll get much more frequent bumps to that, which will result in a progressive march of changes to pubspec.lock

Additional context

#1254 attempted to solve an instance of problems related to this by introducing additional dependency overrides to pubspec.yaml

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant