chore: add script to update package-level package-lock.json

[raymondfeng]

This PR adds a npm script to update package-level package-lock.json files as lerna bootstrap does not do so. See lerna/lerna#1415 (comment) for more details.

Checklist

👉 Read and sign the CLA (Contributor License Agreement) 👈

• npm test passes on your machine
• New tests added or existing tests modified to cover all changes
• Code conforms with the style guide
• API Documentation in code was updated
• Documentation in /docs/site was updated
• Affected artifact templates in packages/cli were updated
• Affected example projects in examples/* were updated

[b-admike]

Does running update-template-deps before or after update-package-lock-json make any difference to the package-lock.json files that are updated?

[raymondfeng]

Not really. But updating package-lock.json files has more chances to fail than update-template-deps.

[b-admike]

LGTM 👍

[bajtos]

I think this is not right. Package lock should not list local dependencies that are linked within monorepo.

In the current setup, npm i (lerna bootstrap) installs monorepo-local packages from the npm registry and replaces any links created by lerna.

[raymondfeng]

For the record, npm i does not update package-lock.json for me even after I added new dependencies to a package.json. That's what led me to discover the issue and put a workaround.

[raymondfeng]

It seems that lerna clean && lerna bootstrap --no-ci does update package-lock.json for all leaf packages. I'll open a PR to use it.

[bajtos]

@raymondfeng I feel this change is very likely going in a wrong direction. Why is it necessary to update package-lock files when we are making new releases? The lock files are not supposed to contain entries for dependencies resolved via symlinks by lerna.

I am fixing the immediate problem in #2593.

I think we should also revert the changes made in package.json by this pull request. Thoughts?

[raymondfeng]

I feel this change is very likely going in a wrong direction. Why is it necessary to update package-lock files when we are making new releases? The lock files are not supposed to contain entries for dependencies resolved via symlinks by lerna.

I wanted to make sure package-lock.json files are up-to-date respecting package.json. For example, if I add a new dependency to packages/rest/package.json, npm i at loopback-next level does not automatically update package-lock.json and it fails CI as CI uses npm ci and the new dep will be missing.