Update dependencies for v2023.5 about central-backend HOT 3 CLOSED

Let's make sure to upgrade bcrypt as described by @spwoodcock at https://forum.getodk.org/t/bcrypt-dependency-install-fails-on-arm64-architectures/43992

I think we still want to keep control over the minor version to ensure consistency but could be convinced otherwise.

(sorry, @swoodcock and @pwoodcock, having typing issues today!)

from central-backend.

I think we still want to keep control over the minor version to ensure consistency but could be convinced otherwise.

Just to clarify, are you thinking of the semver range specified in package.json? package-lock.json is what ensures consistency across installs. The semver range in package.json constrains what updates are possible when a dev runs npm update.

Relatedly, I noticed this statement in the forum post:

It's currently pinned with a tilde ~5, meaning the max version is 5.0.1.

However, I'm pretty sure that ~5 includes any 5.x. I think we can update the version in package-lock.json by running npm update bcrypt, without changing anything in package.json.

from central-backend.

Ah yes I see what you mean about 5.x (npm docs). I just updated bcypt within the package-lock.json file.

from central-backend.