Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Version 1.0.1 has npm as a dependency #8

Closed
sharkykh opened this issue May 26, 2019 · 3 comments
Closed

Version 1.0.1 has npm as a dependency #8

sharkykh opened this issue May 26, 2019 · 3 comments

Comments

@sharkykh
Copy link

sharkykh commented May 26, 2019

Hi!
The recently published version 1.0.1 has npm declared as a direct dependency.
I don't believe this was intended.

$ diff -u chrome-trace-event-git/package.json chrome-trace-event/package.json
Where chrome-trace-event-git is what is available on this git repository, and chrome-trace-event is what I have in my node_modules folder.

--- chrome-trace-event-git/package.json 2019-05-26 06:34:13.000000000 +0300
+++ chrome-trace-event/package.json     2019-05-26 21:57:33.384000000 +0300
@@ -18,6 +18,7 @@
   "main": "./dist/trace-event.js",
   "typings": "./dist/trace-event.d.ts",
   "dependencies": {
+    "npm": "^6.9.0",
     "tslib": "^1.9.0"
   },
   "devDependencies": {
@sharkykh sharkykh changed the title NPM version 1.0.1 has npm as a dependency Version 1.0.1 has npm as a dependency May 26, 2019
@jaydenseric
Copy link

jaydenseric commented May 26, 2019

Suspicious! The npm dependency is not in the source code:

https://github.com/samccone/chrome-trace-event/blob/v1.0.1/package.json#L20

Always alarm bells when the source on GitHub is different to what is published on npm:

https://unpkg.com/chrome-trace-event@1.0.1/package.json

Also, the link to the package repo and source is not displaying on the npm website:

https://www.npmjs.com/package/chrome-trace-event

I don't know why, since the package repository field is there:

https://github.com/samccone/chrome-trace-event/blob/v1.0.1/package.json#L14

A lot of Next.js and Webpack consumers will be affected by the 17.8 MB install size of the npm dependency:

Screen Shot 2019-05-27 at 9 33 41 am

@samccone
Copy link
Owner

thanks for the flag, updating right now.

@samccone
Copy link
Owner

1.0.2 pushed and published.

Thanks all.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants