Skip to content

Avoid propagating loose ranges from resolutions during autofix #398

@bmish

Description

@bmish

In resolutions, it's more common to use > or >= ranges to ensure a dependency is above a particular (especially vulnerable) version.

Example:

package.json:

{
  "workspaces": ["*"],
  "resolutions": {
    "foo": ">= 5"
  }
}

package1/package.json:

{
  "dependencies": {
    "foo": "^4.0.0"
  }
}

The autofix will currently change foo's version to >= 5, which is likely unsafe/overly-aggressive.

Related: #348

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions