Skip to content

Commit

Permalink
Update importmap.md (#29067)
Browse files Browse the repository at this point in the history
Typo: should be doesn't, not don't
  • Loading branch information
Erik-Russell authored Nov 10, 2024
1 parent 93b8ba4 commit 59a149e
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion ruby_on_rails/assets_and_navigation/importmap.md
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,7 @@ pin "md5", preload: false # file lives in vendor/javascript/md5.js

While importmaps are a great way to get started with Rails, and will allow you to quickly make use of JavaScript libraries without having to worry about bundling and transpiling, there are some wider considerations you need to be aware of.

The first consideration is dependency management. This is when the package you are using depends on other packages for their use. Using importmaps locks the version of dependencies as required by the package you are using, but what if you add another package that relies on the same dependency but a different version? You'll start getting errors and tracking them down can be tricky. At this stage, importmaps don't manage dependencies and so are best used when your reliance on third party packages is minimal.
The first consideration is dependency management. This is when the package you are using depends on other packages for their use. Using importmaps locks the version of dependencies as required by the package you are using, but what if you add another package that relies on the same dependency but a different version? You'll start getting errors and tracking them down can be tricky. At this stage, importmaps doesn't manage dependencies and so are best used when your reliance on third party packages is minimal.

Dependency management also feeds into the next consideration. How do you manage versioning of your libraries to keep them up to date? If you use something like webpack that requires an explicit package.json file that maps libraries to version and then a lock file to manage all the dependencies you can then rely on services such as GitHub's [Dependabot](https://github.com/dependabot) to keep those packages up to date for you by submitting pull requests against your GitHub repo to update the packages. When using importmaps there isn't currently a way to do this, so you'll need to manage those updates yourself. If there's a security critical update for a library you rely on and you aren't aware of that? You can leave your app exposed to anyone who can exploit that.

Expand Down

0 comments on commit 59a149e

Please sign in to comment.