Fortunately there are several tools you can use to automate the process, like Renovate. You may be asking who is going to PR the repo every time a new dependency gets released, because this is a very tedious task to be done manually. The whole process can be automated and it's usually very quick. Depending on your answer it will divide the leftmost or rightmost interval and iterate the process until the guilty commit is detected. Instead of doing it manually a git bisect allows you to specify a good commit and a bad commit, then it will pick up a commit in the middle and ask you if it's good or bad. Git bisecting is a quick way to roll back to previous commits and find out which one introduced the regression. Nevertheless pinning still has a big advantage even when the failure is not caught in time: instead of randomly looking for which dependency broke your code, you will be able to bisect the issue very quickly. Truth is that tests are not perfect either and chances are you probably didn't read the release notes looking for breaking changes before merging a green-light PR. So you will know exactly which dependency is going to break your app before that happens.

With pinning, you will have to make a PR to update your dependencies and thus get some feedback from the automated tests. Since multiple dependencies can be updated at once when that happens you will have to manually check which one to blame and then you will be forced to pin it to fix the issue. Unfortunately semantic versioning is far from being infallible and breakage might occur. The theory behind that is that semantic versioning should protect us against breaking chances, while still getting the security fixes. This is done because we want to get security fixes as fast as possible. The main reason is to automatically get updates every time we run npm install (assuming you're not using a lock file, more on that later). Why did package managers default to semver? Package managers like npm or yarn use semver ranges by default, which basically allows you to install a “range” of versions instead of a specific one.īy freezing the dependencies we want to achieve repeatable deployment and make sure that every developer is testing on the very same codebase.

With the term pinning we are referring to the practice of making explicit the version of the libraries your application is depending on.

What is pinning and why is it so important? Looking for experts? We offer consulting and trainings.

Npm install a specific version