Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update README stating this is technique is not safe for publishing #270

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

update README stating this is technique is not safe for publishing #270

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a431029
update README stating this is technique is not safe for publishing
davidmurdoch Oct 7, 2020
2a64086
Update README.md
davidmurdoch Oct 8, 2020
e8e8ff7
add reason behind note
davidmurdoch Aug 18, 2022
50d5e0c
Update README.md
davidmurdoch Aug 18, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,11 @@
<img src="https://ds300.github.io/patch-package/patch-package.svg" width="80%" alt="patch-package" />
</p>

**Note: It is not safe to publish npm packages with patched dependencies!**

`patch-package` lets app authors instantly make and keep fixes to npm
dependencies. It's a vital band-aid for those of us living on the bleeding edge.

Note for module authors: it is not safe to publish an npm package that uses `patch-package` to patch a non-dev-dependency.
Copy link

@laurent22 laurent22 Oct 23, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The "why?" part is missing. Either it's obvious why it shouldn't be done, and there's no need to add this to the readme, or it's not, and that should be explained.

My use case is publishing a CLI application and use patch-package to fix some of the dependencies. It has worked fine for years but lately there's a bug and when I search for some info there's the same "it's not safe" being repeated many times, but it's not explained why or what should be the alternative.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good question. I don't know the why either. I just saw this comment.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe it is because patches are applied to a specific file in your node_modules folder, but when a package is installed by end users the node_modules dependency tree may shift things around, and this shifting could be due to factors that can't be controlled by patch-package.

Also, if the dependency you are patching is also imported by the user of your package, patch package shouldn't patch that version of the package... which is not really possible, at least not without some really weird shenanigans.

To work around this issue I used package.json's bundleDependencies to include the actual dependency I patched in my published package.

Copy link

@papb papb Oct 23, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@davidmurdoch Nice! By the way, I've used bundleDependencies in the past for something else in the past, it works well with npm but I've met an issue with yarn...

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good to know!

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for clarifying @davidmurdoch, perhaps your comment or a shortened version of it could be included in the readme?


```sh
# fix a bug in one of your dependencies
vim node_modules/some-package/brokenFile.js
Expand Down