chore(deps): lock file maintenance

[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[dominykas]

This isn't right. Not sure why renovate removes all the integrity fields - will investigate later.

[dominykas]

Not sure why renovate removes all the integrity fields

This is not renovate doing it - it's npm. And npm seems to do it, because renovate effectively re-runs npm install after removing the lock files (including the hidden lock file). Since we already have node_modules, npm does not bother with fetching anything from the network, so it does not get to see any integrity from the registry (or so it seems).

One could argue this is a bug on npm side, but I can also see this being declared a "won't fix" (I wouldn't hold my breath for a fix anyways), so probably it should be up to renovate to remove node_modules before the install run. Ideally, renovate would also have the option to automatically commit the node_modules into the repo after renovation as well. That said, the behavior we're seeing here is not because renovate is doing something wrong either...

Not sure where best to raise an issue (or possibly in both places). Will have to think about this a little.

[Eomm]

I think it is a matter of renovate Node.js runtime.

https://docs.npmjs.com/cli/v8/configuring-npm/package-lock-json#lockfileversion

Both (the original and the edited package-lock) are processed by npm>=7

Maybe a re-run solve the issue

[dominykas]

No, re-running or changing lockfile version does not help.

I was able to reproduce locally.

Ideally, renovate would support wiping node_modules before renovation, and checking in after. I'll probably raise an issue there.

[dominykas]

Created an issue on renovate side: renovatebot/renovate#13926.

Also checked if there's any packages to be updated - there are none at the moment.

[wesleytodd]

Sorry, I bet this was one of those ones I accidentally closed. I had this repo open looking at the pkgjs/create-pkg repo and just got confused.

[dominykas]

No worries!