Handling package-lock.json for Horreum #1245
Replies: 10 comments 28 replies
-
This could be also a reason to get conflict in lock files |
Beta Was this translation helpful? Give feedback.
-
There are a number of issues that we have with package-lock.json that I think we need to resolve; 1 ) different version of npm produce different output, even within the same output "version" When I get time later today, I will write up my thoughts on each point above. Please and more issues that you see |
Beta Was this translation helpful? Give feedback.
-
If we get this correct, there should not be many conflicts. The only time we will see conflicts is when 2 PRs make changes to the same or adjacent lines, which should be fairly rare. Issues
For this problem, as long as we use
Looking at https://docs.npmjs.com/cli/v10/configuring-npm/package-lock-json - the contents of package-lock.json can change if the content of
I honestly do not know what causes this, but it means the entire 1 - You can not see what has changed, the entire file changes I think we need to find the root cause of this and figure out how to resolve this problem
This is always going to happen, but if we minimise the diffs, the likelihood of this occurring is greatly reduced
It looks like the max version dependabot supports is npm v9, whereas in the project we use npmv10: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file Another thought, that we have kind of implemented already.
If we lock the dependency version, the cascade of updates from dependencies and their transitive dependencies is greatly reduced. Some other options:not check
|
Beta Was this translation helpful? Give feedback.
-
Dependabot was working as expected : b45e1ca Up until this commit: 0baef81 since then the spacing format of package-lock.json has been incorrect |
Beta Was this translation helpful? Give feedback.
-
I will re-commit package-lock.json with the correct spacing, and ensure that dependabot PR's are correctly formatted |
Beta Was this translation helpful? Give feedback.
-
Working fine, I rebased my branch see 7b1b484 closing |
Beta Was this translation helpful? Give feedback.
-
@johnaohara Would it be sensible to enable prettier to in the Action workflow with
|
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
@shivam-sharma7 to re-format the file contents ? |
Beta Was this translation helpful? Give feedback.
-
We REALLY need to fix this issue, PR's are being merged that will cause conflicts e.g.: https://github.com/Hyperfoil/Horreum/pull/1524/files |
Beta Was this translation helpful? Give feedback.
-
@johnaohara I don't know which node/npm version use by dependabot for generating PRs
Beta Was this translation helpful? Give feedback.
All reactions