docs: Remove bad advice about pinning versions.

Because `yarn.lock` includes transitive dependencies, it already pins
our dependencies more comprehensively than `package.json` would if we
followed this bad advice, which we don’t, as of commit
9b0401b76d (#13118).

Signed-off-by: Anders Kaseorg <anders@zulip.com>
This commit is contained in:
Anders Kaseorg 2023-03-05 20:56:28 -08:00 committed by Anders Kaseorg
parent 087660a87e
commit c382904638
1 changed files with 1 additions and 6 deletions

View File

@ -180,12 +180,7 @@ first add it to the appropriate place under `static/`.
`package.json` for management by yarn, this allows them to be upgraded easily `package.json` for management by yarn, this allows them to be upgraded easily
and not bloat our codebase. Run `./tools/provision` for yarn to install the and not bloat our codebase. Run `./tools/provision` for yarn to install the
new packages and update its lock file. You should also update new packages and update its lock file. You should also update
`PROVISION_VERSION` in `version.py` in the same commit. When adding modules `PROVISION_VERSION` in `version.py` in the same commit.
to `package.json`, please pin specific versions of them (don't using carets
`^`, tildes `~`, etc). We prefer fixed versions so that when the upstream
providers release new versions with incompatible APIs, it can't break Zulip.
We update those versions periodically to ensure we're running a recent
version of third-party libraries.
- Third-party files that we have patched should all go in - Third-party files that we have patched should all go in
`web/third/`. Tag the commit with "[third]" when adding or `web/third/`. Tag the commit with "[third]" when adding or
modifying a third-party package. Our goal is to the extent possible modifying a third-party package. Our goal is to the extent possible