Doesn't detect package.json changes

[mjp0]

I'm trying to use patch-package to quick fix modules that haven't been updated for years and they use vulnerable modules like lodash 1.0.1. Yarn lacks a deep upgrade functionality so I figured patch-package might be the easiest and most maintainable option for this.

For some reason when I update package.json for the module, patch-package says there's no changes in the module. Is this a bug or am I just doing something wrong?

[ds300]

Hi 👋 That's expected behaviour. See the --exclude option in the readme. It is possible to override the default --exclude regex to patch a package.json but it unfortunately can't affect yarn's module resolution since patching happens after all modules are installed. The reason package.json is excluded by default is that npm adds a bunch of noise to those files which changes depending on the location where it was installed. If you use yarn it should be fine. Happy patching!

…

On Thu, 12 Apr 2018, 08:06 Fork, ***@***.***> wrote: I'm trying to use patch-package to quick fix modules that haven't been updated for years and they use vulnerable modules like lodash 1.0.1. Yarn lacks a deep upgrade functionality so I figured patch-package might be the easiest and most maintainable option for this. For some reason when I update package.json for the module, patch-package says there's no changes in the module. Is this a bug or am I just doing something wrong? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#48>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABL1qUsJuNIZYwQ-qZ2KBvUvsxDid4YMks5tnvz5gaJpZM4TRP1v> .

[mjp0]

Ok, thanks! Surprisingly hard to do such a simple thing like updating a dependency of a dependency...