Use ZeroMQ 5.2.4 - fix build on Electron 9

[aminya]

Fixes #31

[n-riesco]

"5" and "^5" are equivalent.

See https://semver.npmjs.com/ if you want to play with different combinations.

I don't find '^' and '~` readable.

[aminya]

@n-riesco I updated the PR to use the fixed ZeroMQ. I will release Hydrogen by a link to my GitHub branch for now until you merge this.

[n-riesco]

I see in https://www.npmjs.com/package/zeromq?activeTab=versions that [email protected] has already been released.
We don't need this PR, do we?

[aminya]

I updated ZeroMQ. This PR now includes the working ZeroMQ 5.

[n-riesco]

I'm sorry I wasn't clear before. This PR is not really necessary.
"zeromq": "5" describes exactly what jmp@2 requires.

• it doesn't patch a bug in [email protected]
• it doesn't add any functionality to jmp@2 (that I'd release as a minor version update)
• it doesn't drop support for any functionality (that I'd release as a major version update)

jmp is a library and uses semver (i.e. it lets the user decide whether they want to use a specific version or they are happy with npm's choice).

The purpose of semver is exactly that (otherwise every time a dependency made a new release would trigger a cascade of releases in the depedants).

jmp doesn't release any assets that should be built in a reproducible manner (and thus, it doesn't publish a package-lick.json).

[aminya]

I am not a fan of using semver for dependency management as it makes everything unreproducible. Releasing a new version is also a way of informing downstream about the changes in the behavior of JMP (caused by its dependencies in this case).

[n-riesco]

Releasing a new version wouldn't just be informing downstream.
It'd be forcing them to use the updated dependencies, and preventing them from downgrading if needed.

[n-riesco]

@aminya package-lock.json was introduced exactly for that reason: to inform users of the versions needed to reproduce a build. The versions in package.json describe compatibility.