Update to latest @pact-foundation/pact-core

[mcalthrop]

Could you please create a new release that updates the version of @pact-foundation/pact-core?

It contains this fix: pact-foundation/pact-js-core#729.

Current version: 17.0.0
Fixed version: 17.0.1

many thanks

Matt

[mefellows]

Pact uses the ^ selector for that package, which means you can run npm update to automatically pull in updates to transitive dependencies according to the semver constraints.

I'll get a patch release out for Pact JS shortly though.

[mcalthrop]

Pact uses the ^ selector for that package, which means you can run npm update to automatically pull in updates to transitive dependencies according to the semver constraints.

I'll get a patch release out for Pact JS shortly though.

Thanks Matt.

My understanding is that the version in the lock file is what is used, and that was 17.0.0 when I raised this issue – although I can see that the lock file has been updated since then.

[mefellows]

The lock file is only for use by the local project. Consuming projects get the semver rules.

On a fresh install of the current Pact JS package, it installs the latest pact-core:

>  npm init -f
npm warn using --force Recommended protections disabled.
Wrote to /private/tmp/foo/package.json:

{
  "name": "foo",
  "version": "1.0.0",
  "main": "index.js",
  "devDependencies": {},
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "description": ""
}

> npm install --save-dev @pact-foundation/pact

added 132 packages, and audited 133 packages in 7s

25 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities
> npm list @pact-foundation/pact-core
foo@1.0.0 /private/tmp/foo
└─┬ @pact-foundation/pact@16.0.2
  └── @pact-foundation/pact-core@17.0.1

For existing projects, npm update will bring all of the latest (allowed) transitive dependencies to come in.

[mcalthrop]

@mefellows Ok, thanks. This is why I always pin to exact versions: the results are always deterministic.

With the setup in this repo, the consumer of the package might be using a different version of it from what the package itself uses – and is tested against.