github/hubot — pull request #710 by patcon (2014-06-05 19:00:45+00:00)
Title: Update express to fix loosely pinned downstream dep

Re-shrinkwrapped my hubot this morning and found this crash error on heroku:

```
2014-06-05T18:17:00.920746+00:00 heroku[web.1]: State changed from crashed to starting
2014-06-05T18:17:06.781727+00:00 app[web.1]: SyntaxError: Error parsing /app/node_modules/hubot/node_modules/express/node_modules/debug/node_modules/ms/package.json: Unexpected end of input
2014-06-05T18:17:06.781752+00:00 app[web.1]: at Function.Module._resolveFilename (module.js:336:25)
2014-06-05T18:17:06.781751+00:00 app[web.1]: at Function.Module._findPath (module.js:190:18)
2014-06-05T18:17:06.781745+00:00 app[web.1]: at Object.parse (native)
2014-06-05T18:17:06.781748+00:00 app[web.1]: at readPackage (module.js:113:52)
2014-06-05T18:17:06.781749+00:00 app[web.1]: at tryPackage (module.js:123:13)
// ...
```

```diff
[33md5879bc[m -[31m[m Add grunt-release branch to bump shrinkwrap version. 

// ...

diff --git a/npm-shrinkwrap.json b/npm-shrinkwrap.json
index 884a7ff..c4b701b 100644
--- a/npm-shrinkwrap.json
+++ b/npm-shrinkwrap.json
@@ -145,20 +148,29 @@
"resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.1.tgz"
},
"debug": {
- "version": "0.8.1",
- "from": "debug@*"
+ "version": "1.0.0",
+ "from": "debug@*",
+ "resolved": "https://registry.npmjs.org/debug/-/debug-1.0.0.tgz",
+ "dependencies": {
+ "ms": {
+ "version": "0.6.2",
+ "from": "ms@0.6.2",
+ "resolved": "https://registry.npmjs.org/ms/-/ms-0.6.2.tgz"
+ }
+ }
}
}
}
}
},
"hubot-auth": {

// ...

```

Seems that the express version that hubot is using (v3.3.4), has a wildcard for `debug`:
https://github.com/visionmedia/express/blob/3.3.4/package.json#L35

This allowed a sneaky version bump from v0.8.1 to v1.0.0, which has the suspect `ms` package seen in the error.

The next minor version that constrains the `debug`package is v3.4.8:
https://github.com/visionmedia/express/blob/3.4.8/package.json#L36

I'll test it out and submit a PR, if that sounds alright.

Here's the CHANGELOG diff, but it should be anything breaking:
https://github.com/visionmedia/express/compare/3.3.4...3.4.8#diff-e1bbd4f15e3b63427b4261e05b948ea8R16