lockbox-extension

lockbox-extension copied to clipboard

I've noticed that Greenkeeper is only updating stuff whose major or minor version has changed, not the patch version. This seems like a problem, since it means we'd have to check regularly for patch-level changes, nullifying the benefits of Greenkeeper managing this for us.

Maybe there's just something wrong with our config? @linuxwolf Any ideas?

Without a lockfile, updates that are within semver matches are completely unnecessary. With a lockfile, it gets more complicated.

What we can do is one of two things:

1. Enable greenkeeper-lockfile in our Travis-CI builds; this will push updates to the package-lock.json periodically, which might get more noisy
2. Remove the package-lock.json and add it to .gitignore

I'd lean towards the former, especially if there's a way to rate-limit Greenkeeper PRs (though I'd be kind of surprised if there were).

I'm not too keen on removing package-lock.json, since it reduces the reproducibility of our builds. Matt B may end up doing tests on [email protected] and then we end up shipping with [email protected] which breaks something for users. That should be rare for patch-level updates, but it's always a possibility.

@m8ttyB, what do you think about the above?

+1 to @jimporter's concern