Add policy on using caret (^) or tilde (~) with dependencies

[UlisesGascon]

Policy on using caret (^) or tilde (~) with dependencies

• Establishes policy for using caret (^) or tilde (~) for dependencies that we maintain while avoiding its use for third-party dependencies.
• Explains the differences between caret (^) and tilde (~) version ranges.
• Documents the rationale, alternatives considered, and implementation plan.

Context

• closesDiscussion: Using caret (^) with our own dependencies #279
• related Re-thinking the discussion process #285

[blakeembrey]

TL;DR I think we should try to be high trust and good examples of OSS by treating all dependencies the same.

[wesleytodd]

If @UlisesGascon is alright with the suggestions to use ^ for all, I tried to make change suggestions to everywhere I noticed where it was referenced. Personally I think the conservative approach used in earlier days is not necessary anymore and so am in favor of using it for all deps.

[UlisesGascon]

Worth mentioning that the caret (^) is not supported on Node@0.8, as noted in this comment. Therefore, this change might be considered semver-major in many scenarios unless we decide that dropping support for Node@0.8 is not a major change. 😄

[ljharb]

@UlisesGascon it's not supported on the npm that comes with node 0.8, but if you use nvm install-latest-npm to get the latest one, then it works just fine :-)

either way, i think it can be fine if you need a newer node to install it as long as it works in old node (albeit, not ideal)

[bjohansebas]

So we need to prepare the CI for the packages that still support node.js@0.8 before making any changes to the dependencies

[ljharb]

Yes, for any package that isn't already declaring engines, the first step should be testing (manual or automated) to determine on which versions it's already working - because those are the engines that it's non-breaking to declare.

[bjohansebas]

@expressjs/express-tc, the way forward is to update the CI, or do we prefer to do this in a major version when support for Node.js 0.8 is removed?

[wesleytodd]

I think the suggestions are mostly agreed upon, @UlisesGascon if you want to make these I can change my review to approved and we can merge this right? (or if you want I can merge them and do it myself, just didn't want to step on your toes)

The rest of the questions/comments dont seem applicable now right?

[wesleytodd]

he way forward is to update the CI, or do we prefer to do this in a major version when support for Node.js 0.8 is removed?

Ref: expressjs/compression#214 (comment)

I don't think we should make the CI more complicated by applying this change to packages we have not rev'd to drop node versions. I think it is better to do nothing to those until we have another reason to major rev them.

[jonchurch]

Im in favor of caret being the default for all deps, external or not. AKA I want to accept the suggestions to change the proposal to state that.

[UlisesGascon]

ok... I think that this is ready for a final review, please feel free to suggest changes and create new discussions if something is not described as agreed previously.