diffplug / diffplug/spotless

Allow `npm`-Based Formatters to Pin Transitive Dependencies by Populating `overrides` in `package.json`

Open
#2,534 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
5.6k
Forks
559
Avg merge
1d 13h
Merged PRs (30d)
34

Description

When using an npm package to format code, and that npm package has a range dependency onto another library, the formatting output can change silently. This just happened to us: we use `prettier-plugin-sql`, which has a `^`-dependency on `sql-formatter`. `sql-formatter` released a new version that changed the formatting output, and our project’s build broke because the checked-in SQL files didn’t match the expected format.

Proposal: add the configuration method `dependencyOverrides` to `PrettierFormatterStep`. This method accepts a `Map` to populate the [`overrides` field](https://docs.npmjs.com/cli/v11/configuring-npm/package-json#overrides) in the generated `package.json`. This mechanism could work exactly like the one populating the `devDependencies`.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.