Running npm audit fix --force

[abchatra]

No description provided.

[riknoll]

hmmmm... looks like this broke our testing code

[eanders-ms]

We don't have a package-lock.json, so version numbers should not be loose matches; no ^, ~, etc. We need to ensure that the build machine uses the same package versions we developed with and tested locally. Why are we not using package-lock.json here?

[eanders-ms]

Lock version numbers or introduce package-lock.json. Otherwise we don't know what we're shipping.

[abchatra]

Some of these are test only like karma & mocha. We should be ok without exact versions right?

[eanders-ms]

Some of these are test only like karma & mocha. We should be ok without exact versions right?

Sure, but would it not be simpler to lock them all? My preference would be to add a package-lock file actually.