#976440 pkg-js-tools: add a minimal test to check the dependencies in package.json does not differ by major versions

Package:
lintian
Source:
lintian
Submitter:
Pirate Praveen
Date:
2020-12-17 18:33:03 UTC
Severity:
wishlist
#976440#5
Date:
2020-12-05 09:26:33 UTC
From:
To:
It would be nice to have a test in pkg-js-tools to make sure the
dependencies mentioned in package.json of a module is not differing by
a major version.

Example node-css-loader. See
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976408#57 for list
dependencies with mismatched versions.

package.json has postcss-modules-extract-imports": "^2.0.0" but
node-postcss-modules-extract-imports in the archive is 3.0.0-1.

In ruby team, gem2deb does this already. It will test if dependencies
mentioned in gemspec is satisfied and fail in case of mismatch. If we
know the mismatch is not a problem, we add a patch to adjust the
required version.

GEM_PATH= ruby2.7 -e gem\ \"faraday\" is how gem2deb tests it.
#976440#10
Date:
2020-12-17 18:07:48 UTC
From:
To:
Le 17/12/2020 à 19:00, Xavier a écrit :

For embedded components, see also
https://salsa.debian.org/debian/devscripts/-/merge_requests/207
#976440#15
Date:
2020-12-17 18:00:00 UTC
From:
To:
Hi,

such test should not fail because it will creates a lot of
false-positive FTBFS. I can write a test that returns OK or SKIP but
then what is the benefit?

Cheers,
Xavier
#976440#20
Date:
2020-12-17 18:23:54 UTC
From:
To:
Quoting Xavier (2020-12-17 19:00:00)

Quite helpful if such SemVer violations appeared as lintian warnings.

Having them appear there would help also outside of the JavaScript team
- e.g. as a "smell": https://trends.debian.net/#smells


 - Jonas
#976440#25
Date:
2020-12-17 18:31:36 UTC
From:
To:
Le 17/12/2020 à 19:23, Jonas Smedegaard a écrit :
lintian isn't launched with build dependencies in debci machines AFAIK

@Felix, do you prefer a PR to lintian or a test in pkg-js-tools "extras"?

Cheers,
Xavier