Update dependencies

[DylanVann]

Using ^ in versions is less risky now because almost all consumers will be using newer yarn or npm versions, which both use lockfiles.

In the event a dependency is broken users can easily fix it using yarn or npm resolutions.

Advantages:

• Consumers can avoid duplication.
• Consumers can get semver compatible bug fixes without needing this module to be updated.

Also a new version release would be appreciated, although I understand if you're busy.

[DylanVann]

People may have their editor configured with default prettier settings. Explicitly setting an empty config ensures that the default settings are used instead of those set by the user.

[SimenB]

I'm in favour, dunno if @af is, though 🙂

[DylanVann]

I could make this an npm lockfile if you prefer.

The advantage of having this is that in the event that a dependency of envalid is broken you can see from this lockfile what exact versions of modules are working, and then debug from this point.

[DylanVann]

@SimenB Out of curiosity, what do you use that depends on this? I don't see Jest using it.

We use Envalid at a company I'm working with. We were adding Cypress tests and Envalid didn't work so I used Yup instead as a stopgap. This has me thinking, maybe Envalid is just a special case of yup. Maybe yup could be used for most of the internals.

I think it would be easy to add things like #81 (and also url validation) if yup were used.

Regarding the size of universal-url, maybe it doesn't matter, I'd hope nobody would use this to validate environment variables on a production website. It's sort of similar to PropTypes, probably better that it's compiled out of production. For example if we did use yup for the internals then it would be 20kb gzipped, which I don't think is acceptable in production unless the consumer was already using yup.

[SimenB]

I use it at work 🙂 Just for backend though, not client side (web or RN)

[af]

I've resisted ^ in the past because I still don't like the idea of dependencies being declared inexactly. Besides the possibilities of bugs being shipped in patch versions of deps (it happens), there's the potential vulnerabilities of left-pad/event-stream - type incidents.

That said, you're right that lockfiles are now the norm (I've been using them for a few years so I realize the above borders on paranoia :P). I'll relent on this and we can re-assess if any issues come up. Thanks for the PR!

[af]

Also published v4.2.0! Thanks for the reminder, that was overdue