When we update or change npm dependencies we are forced to run `kotlinUpgradeYarnLock` before assemb...

# javascript

[Edoardo Luppi]

When we update or change npm dependencies we are forced to run kotlinUpgradeYarnLock before assembling again. If not, assembling fails.

I wonder if this task could be setup to run automatically if dependencies changes are found. This would remove the additional step compared to K/JVM.

It's not a big deal, just a DevEx improvement imo.

[Carter]

This is a feature, not a bug. The point is to make sure that dependencies don’t change unexpectedly.

If you have Gradle dependency locking enabled, the behavior is the same.

[jw]

Set yarnLockAutoReplace = true. See https://kotlinlang.org/docs/js-project-setup.html#reporting-that-yarn-lock-has-been-updated

[jw]

But yes, I agree the current behavior is the best. And you would see the same behavior from Gradle if you used its native dependency locking (https://docs.gradle.org/current/userguide/dependency_locking.html) for the JVM targets.

[Edoardo Luppi]

Thanks! Didn't know those Yarn options were already there. Nice!

[Edoardo Luppi]

The point is to make sure that dependencies don’t change unexpectedly

Understandable, tho it's quite frustrating during the prototyping phase, every time I forget to run it.

[Carter]

There was a significant incident about 2 years ago, where a JavaScript package that Kotlin uses was updated with a malicious new version. Because NPM package versions weren’t pinned with a lock file at the time, any Kotlin/JS developer that happened to simply compile their application during a window of time would automatically download the new dependency version, run system install scripts, and had their computer infected with crypto mining spyware.

[Carter]

https://blog.jetbrains.com/kotlin/2021/10/important-ua-parser-js-exploit-and-kotlin-js/

[Edoardo Luppi]

I think majory of users simply run kotlinUpgradeYarnLock assemble without even thinking about it.
So probably the end result wouldn't change.
I check the dependencies I'm going to include obviously.

[Carter]

You do you. I just want to make sure you’re able to make an informed decision.

[hfhbd]

For prototyping I just disable the lockfile (locally) but keeping enabled on remote/main branch.

[Edoardo Luppi]

@hfhbd thanks! That's also a valid option