chore(npm lockfile update): update npm lockfile to v2 #955
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Lockfile v2 is backwards compatable with all v1 and v2 lockfiles. It contains more information that would otherwise be included in node_modules. See https://docs.npmjs.com/cli/v7/configuring-npm/package-lock-json#lockfileversion
|
Kudos, SonarCloud Quality Gate passed!
|
Codecov Report
@@ Coverage Diff @@
## master #955 +/- ##
=======================================
Coverage 65.02% 65.02%
=======================================
Files 24 24
Lines 852 852
Branches 157 157
=======================================
Hits 554 554
Misses 270 270
Partials 28 28 Continue to review full report at Codecov.
|
|
Have you tested this with I used first latest for my PR but it had issues with builds that combined Even if backwards compatible, I would only switch to it once the version of npm that introduces it/support all the features is bundled with a Node LTS version, as we're sticking with LTS stuff everywhere, like in CI. We've also been using the v1 lockfile version of yarn for quite some time without any plan to switch to v2, and that switch was even more important as yarn 1 is already in maintenance mode, that's why I don't see a reason why we should rush this now 😁. |
I absolutely agree with this. We'll only migrate to the new format once Node and Node LTS support a version of NPM that uses it, even if backwards compatible. People shouldn't have a newer npm installed anyway, unless they manually update, which isn't recommended. |
|
The original reason was when using v7 it automatically recreates/updates the lock file version to v2. But upon closer inspection, also fixes the following security issues: NPM v6 does not identify these vulnerabilities. (Produced by running Before (43 vulnerabilities (21 low, 2 moderate, 17 high, 3 critical))After (2 high severity vulnerabilities)```axios <0.21.1 2 high severity vulnerabilities |
npm v7 is used in node v15 nodejs/node#35631 |
|
@camc314 But Node 15 is not LTS, only even versions are LTS as per their docs |
|
That's what I said. npm 7 is used in node 15, the current latest version |
|
But we're not aiming for latest versions, we're aiming for LTS (Long-Term Support) ones all the time afaik. Correct me if I'm wrong @MrTimscampi |
|
Ok that's fine. I understand why you'd want to use npm v6 How ever the security issues raised are still of concern. |
You are correct. I'm expecting us to move to Node 16 probably around May-June (When it had like a month to get adopted by the various dependencies and such). |
|
Ok That's fine I understand the reasons for using npm v7. Please see the concerns I highlighted above regarding security though. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Lockfile v2 is backwards compatible with all v1 and v2 lockfiles. It contains more information that
would otherwise be included in node_modules. See
https://docs.npmjs.com/cli/v7/configuring-npm/package-lock-json#lockfileversion