INQUIRY: why is puppeteer version locked to an older version v1.20.0?

As per

https://github.com/sportradar/aws-azure-login/blob/master/package.json#L41 The puppeteer version is locked to version 1.20. ( released on Sep 13, 2019)

However, there are much newer and later versions released: https://github.com/puppeteer/puppeteer/releases

This means that users running aws-azure-login are restricted to an older version, which is likely prone to unpatched security and functionality issues. Further, for those companies that use multi-factor authentication, these systems complain that the browser is “too old” and may prevent authentication on an archaic version.

There may be other tickets/roadmap items to address this (took a quick scan of open issues did not find it). Hoping to glean a bit more information.

Thanks!

[mcallaghan-bsm]

Ah yes definitely - confirmed per:

• https://nodesource.com/blog/the-basics-of-package-json-in-node-js-and-npm/
• https://nodesource.com/blog/semver-a-primer/

[kennethaasan]

If we pin it to the latest version, there is no way to guarantee that puppeteer won’t do any breaking changes that could potentially break this tool. Though, with the caret before the version, it will stay updated on minor and patch updates which should be good enough. In this case, it was a major upgrade, which you should always do manually. Sound good?