WIP: review all dependency versions, add bundledDependencies

package.yaml

@@ -18,52 +18,79 @@ bin:
   sinopia: ./bin/sinopia
 
 dependencies:
-  # don't receive future updates to express.js until
+  # watch out for future updates to express.js until
   # https://github.com/strongloop/express/issues/2264
   # gets resolved:
-  express: '>= 3.4.7 <= 3.15.2'
+  express: '>=3.15.0 <=3.16.3'
 
-  commander: '>= 2.1.0'
-  js-yaml: '>= 3.0.1'
-  cookies: '>= 0.3.8'
-  request: '>= 2.31.0'
-  async: '>= 0.2.9'
-  semver: '>= 2.2.1'
-  minimatch: '>= 0.2.14'
-  bunyan: '>= 0.22.1'
-  mkdirp: '>= 0.3.5'
-  handlebars: '1.x.x'
+  commander: '>=2.3.0 <3.0.0-0'
+  js-yaml: '>=3.0.1 <4.0.0-0'
+  cookies: '>=0.5.0 <1.0.0-0'
+  request: '>=2.31.0 <3.0.0-0'
+  async: '>=0.9.0 <1.0.0-0'
+
+  # 2.x and 3.x have the same interface
+  semver: '>=2.2.1 <4.0.0-0'
+
+  minimatch: '>=0.2.14 <2.0.0-0'
+  bunyan: '>=0.22.1 <2.0.0-0'
+  handlebars: '1.x'
+  highlight.js: '8.x'
+  lunr: '>=0.5.2 <1.0.0-0'
+  marked: '>=0.3.2 <1.0.0-0'
+
+  # bundled deps, see below
+  mkdirp: '>=0.3.5 <1.0.0-0'
+  unopinionate: '>=0.0.4 <1.0.0-0'
+  onclick: '>=0.1.0 <1.0.0-0'
+  onscroll: '>=0.0.3 <1.0.0-0'
+  transition-complete: '>=0.0.2 <1.0.0-0'
   helpers.less: 'git://github.com/bpeacock/helpers.less.git'
-  highlight.js: '^8.0.0'
-  lunr: '^0.5.2'
-  marked: '^0.3.2'
-  onclick: '^0.1.0'
-  onscroll: '0.0.3'
-  tar.gz: '^0.1.1'
-  transition-complete: '0.0.2'
-  unopinionate: '0.0.4'
+
+  # TODO: not really needed
+  tar.gz: '~0.1.1'
 
 optionalDependencies:
-  fs-ext: '>= 0.3.2'
-  crypt3: '*'
+  # those are native modules that could fail to compile
+  # and unavailable on windows
+  fs-ext: '>=0.3.2 <1.0.0-0'
+
+  # bundled
+  crypt3: '>=0.1.5 <1.0.0-0'
+
+# Policy for now:
+# - small, unstable and rarely updated libraries (i.e. crypt3) get bundled
+# - big, stable and frequently updated libraries (i.e. request) don't
+#
+# When sinopia@1.0.0 gets out, all deps will probably be
+# bundled to increase stability and reduce install time.
+bundledDependencies:
+  - mkdirp
+  - unopinionate
+  - onclick
+  - onscroll
+  - transition-complete
+  - helpers.less
+  - tar.gz
+  - crypt3
 
 devDependencies:
-  rimraf: '>= 2.2.5'
-  mocha: '>= 1.17.0'
+  rimraf: '>=2.2.5 <3.0.0-0'
+  mocha: '>=1.17.0 <2.0.0-0'
 
   # linting tools
-  eslint: '~ 0.6.0'
+  eslint: '~0.6.0'
 
   # for debugging memory leaks, it'll be require()'d if
   # installed, but I don't want it to be installed everytime
   #heapdump: '*'
 
-  browserify: '^3.46.0'
+  browserify: '>=3.46.0 <4.0.0-0'
   browserify-handlebars: '~0.2.0'
-  grunt: '^0.4.4'
-  grunt-browserify: '^2.0.8'
-  grunt-contrib-less: '^0.11.0'
-  grunt-contrib-watch: '^0.6.1'
+  grunt: '>=0.4.4 <1.0.0-0'
+  grunt-browserify: '>=2.0.8 <3.0.0-0'
+  grunt-contrib-less: '>=0.11.0 <1.0.0-0'
+  grunt-contrib-watch: '>=0.6.1 <1.0.0-0'
 
 keywords:
   - private