memdown@1.2.3 tarball is missing immediate.js (?)

[yhahn]

Just ran into this after getting an updated memdown as a dependency of dynalite. After a quick glance very strangely it seems like ./immedate.js is missing from the npm package of the 1.2.3 release (though present in this repo):

$ curl -s https://registry.npmjs.org/memdown/-/memdown-1.2.3.tgz | tar zxv
package/package.json
package/README.md
package/LICENSE
package/memdown.js
$ cd package
$ npm install
$ node package/memdown.js
module.js:327
    throw err;
    ^

Error: Cannot find module './immediate'
    at Function.Module._resolveFilename (module.js:325:15)
    at Function.Module._load (module.js:276:25)
    at Module.require (module.js:353:17)
    at require (internal/module.js:12:17)
    at Object.<anonymous> (/home/mapbox/tmp/package/memdown.js:10:20)
    at Module._compile (module.js:409:26)
    at Object.Module._extensions..js (module.js:416:10)
    at Module.load (module.js:343:32)
    at Function.Module._load (module.js:300:12)
    at Function.Module.runMain (module.js:441:10)

Not sure how but it seems like this file was omitted unintentionally from the npm package in the latest release?

cc @nolanlawson

[vweevers]

The package.json has an empty files array, so any js files other than main are ignored by npm: https://github.com/Level/memdown/blob/master/package.json#L53

[SilentCicero]

I'm getting this error as well @vweevers @yhahn , very new as of a second ago from installing

[SilentCicero]

Error: Cannot find module './immediate'
    at Function.Module._resolveFilename (module.js:455:15)
    at Function.Module._load (module.js:403:25)
    at Module.require (module.js:483:17)
    at require (internal/module.js:20:19)
    at Object.<anonymous> (/home/nick/github/wafr/node_modules/memdown/memdown.js:10:20)
    at Module._compile (module.js:556:32)
    at Object.Module._extensions..js (module.js:565:10)
    at Module.load (module.js:473:32)
    at tryModuleLoad (module.js:432:12)
    at Function.Module._load (module.js:424:3)
    at Module.require (module.js:483:17)
    at require (internal/module.js:20:19)
    at Object.<anonymous> (/home/nick/github/wafr/node_modules/merkle-patricia-tree/baseTrie.js:3:17)
    at Module._compile (module.js:556:32)
    at Object.Module._extensions..js (module.js:565:10)
    at Module.load (module.js:473:32)
    at tryModuleLoad (module.js:432:12)
    at Function.Module._load (module.js:424:3)
    at Module.require (module.js:483:17)
    at require (internal/module.js:20:19)
    at Object.<anonymous> (/home/nick/github/wafr/node_modules/merkle-patricia-tree/index.js:1:80)
    at Module._compile (module.js:556:32)
    at Object.Module._extensions..js (module.js:565:10)
    at Module.load (module.js:473:32)
    at tryModuleLoad (module.js:432:12)
    at Function.Module._load (module.js:424:3)
    at Module.require (module.js:483:17)
    at require (internal/module.js:20:19)
    at Object.<anonymous> (/home/nick/github/wafr/node_modules/merkle-patricia-tree/secure.js:1:86)
    at Module._compile (module.js:556:32)
    at Object.Module._extensions..js (module.js:565:10)
    at Module.load (module.js:473:32)
    at tryModuleLoad (module.js:432:12)
    at Function.Module._load (module.js:424:3)
    at Module.require (module.js:483:17)
    at require (internal/module.js:20:19)
    at Object.<anonymous> (/home/nick/github/wafr/node_modules/web3-provider-engine/node_modules/ethereumjs-vm/lib/stateManager.js:1:76)

[nolanlawson]

fixed in #63. very dumb mistake on my part. sorry about that!! 🙇

[SilentCicero]

@nolanlawson I think this is why we all need to version harden everything and not use the "^x.x.x" versioning on packages. That ^ is the difference between blowing up and stable sometimes. It's crazy that a build of my module 4 deps away from yours blew up because you made a mistake. Not to say this your fault or anything. Just a thought on the broader NPM ecosystem.

[nolanlawson]

That doesn't solve the problem of deps-within-deps (you can fix dep B but if it depends on C with ^ then you're screwed), but I totally feel you.

I have been broken at least a dozen times by dependencies pushing stupid mistakes; I guess I'm just paying it forward here 😅

[SilentCicero]

@nolanlawson oh yeah, I'm more of less just saying if we all made a habit of it and maybe used greenskeeper to keep up to date. IMO we would all be better off. It's a collective push for a more scientific NPM/JS ecosystem.

Anyway, great module non-the-less, carry on 👍

[yhahn]

@nolanlawson @vweevers thx for coordinating on the quick fix 👌

[kumavis]

the canonical npm solution to hardening deps is https://docs.npmjs.com/cli/shrinkwrap