Lock down dependency versions

[wojciechpolak]

Hello,

I think it would be much better and safer to lock down all dependency versions to even the minor ones. Right now, using ^ in package.json (which means "any recent major version") makes it very difficult to track problems between different envs and even here when one would like to report an issue. Especially for stuff like babel-, systemjs-, jspm, angular 2, and so on, which recently and constantly break with its "beta" versions every few days or so. What do you think?

[zckrs]

Unfortunately and unwillingly I agree to lock some problematic main dep like babel, systemjs, jspm, angular2

[Swiip]

Our politic has been to open versions number while in alpha to force us to keep up with last versions of deps and detect as soon as possible breaking changes.

But we faced of course lots of breaks (thanks a lot @micaelmbagira to fix them every time!). It's a bit obvious now that to go beta, we'll have to fix version, especially libs in beta: Gulp, Webpack, SystemJS, Angular2. Perhaps Babel too yep.

Still, it will requires a very active support to keep updating manually versions. It could be quick to have 5 versions late on Angular 2 ;)

[wojciechpolak]

From my experience on larger commercial projects and even personal, after work, projects -- it's always good to lock down every single dependency :) And only bump stuff manually after doing a real testing. It saved me a lot of trouble and precious time (and money ;)).

[wojciechpolak]

Update 'Friday the 13th'... Today I lost a good hour while debugging TypeScript version w/ SystemJS on why "build" doesn't produce any static revisioning nor sourcemaps (in the dist folder). Then I recalled that gulp-filter 4.0.0 is somehow broken and rolling back to 3.0.1 solves the problem. Please confirm this and if so, please lock down gulp-filter in package.json to 3.0.1 or another workaround is required. More here: sindresorhus/gulp-filter#67

[Swiip]

Done in 0.5