browserify-resolutions - npm Package Compare versions

Comparing version 1.0.4 to 1.0.5

index.js

@@ -187,2 +187,4 @@ var _         = require('lodash');
           _.each(modules, function(sources) {
+            var resolvedSource;
+
             if (sources.length < 2) {
@@ -193,5 +195,8 @@ // Found no dupes, bail.
 
-            // Let the first package we come across determine the version we resolve for.
-            // TODO?: Allow choosing a version, but that's more difficult.
-            var resolvedSource = sources.shift();
+            // Resolve the most shallow package (in terms of path length) as the "original".
+            // Otherwise, the bundle may be non-deterministic as the order of module-deps's
+            // package traversal currently isn't dependable.
+            // TODO?: Allow choosing a specific package version, but that's more difficult.
+            sources = _.sortBy(sources, 'length');
+            resolvedSource = sources.shift();
             resolved[resolvedSource] = true;
@@ -198,0 +203,0 @@

package.json

 {
   "name": "browserify-resolutions",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "A Browserify plugin that allows more explicit control of module deduping. It purges duplicate modules from the output bundle and prevents modules from loading several times.",
@@ -5,0 +5,0 @@ "main": "index.js",

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

23591

1.08%

Lines of code

547

0.74%

Number of medium supply chain risk alerts

0

-100%

No dependency changes