Vega: Why dependencies version are not fixed ?

[austil]

Hi, today I ran into the following problem :

I'm working on a project that's using Vega 5.4.0 and TypeScript 3.3.
Everything used to be fine until today when the build of this project failed.
But nothing had changed, at least on my side.

After investigating I found out that dependencies of the Vega package are not fixed.
Vega-util (a sub-dependency to my perspective) was updated from 1.10.0 to 1.11.2 and between those two minor version the minimum Typescript support went from 2.7 (fine for me) to 3.4 (my project can't build) https://github.com/vega/vega/commit/da777eb906c370438f2f476a9cadd18b8e0c2667.

I don't think this behavior is intended :upside_down_face:
Good practice suggest not using dependencies ranges (with *~^<>) but fixing dependencies version to avoid this type of issues.

May relate to #1259.

What are your though on that ?

Best regards.

Augustin :fr:

[anagrius]

This is exactly what got us in trouble recently as well. We could not easily downgrade without having to pin exact dependencies.

[jheer]

Thanks for the suggestion! We'll take this into consideration for future releases. Up until this point, folks haven't raised this as an issue, but I certainly understand how frustrating this could be.