make @babel, browserslist versions ^

[dulmandakh]

Babel, and browserlist are well maintained open source project, thus propose to make versions less explicit or use ^ so that developers have less duplication.

[gregmarr]

@iansu @mrmckeb @ianschmitz @petetnt The current dependencies include a pinned version that has a security vulnerability. Can this please be reviewed so that we can resolve this issue?

[stale]

This pull request has been automatically marked as stale because it has not had any recent activity. It will be closed in 5 days if no further activity occurs.

[gregmarr]

Not stale

[mlegait]

Any news about this? 🙂

[Hypnosphi]

@mlegait if you're asking it because of npm audit, please read this:
#11174

[mlegait]

@Hypnosphi I was asking because of OWASP dependency-check, but it's clearly the same as npm audit.

Thank you for your answer. But I'm still curious, why block the version number? Why not add a ^?

[Hypnosphi]

@mlegait here's some explanation: #11174 (comment)

[dulmandakh]

My motivation is to reduce duplicate dependencies in my projects with slight patch version difference.

[dulmandakh]

@gaearon please review and merge

[stale]

This pull request has been automatically marked as stale because it has not had any recent activity. It will be closed in 5 days if no further activity occurs.