Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add missing package integrity #829

Merged
merged 1 commit into from
Jan 13, 2025
Merged

Conversation

petrzjunior
Copy link
Contributor

📑 Summary

Add integrity field where missing the package-lock.json. This enforces the dependency checksum and allows for Nix packaging.

Resolves #828

📏 Design Decisions

I used https://github.com/jeslie0/npm-lockfile-fix script to fill in the integrity fields. Packages install on my machine.

📋 Tasks

Make sure you

  • 📖 have read the contribution guidelines
  • 💻 have added unit/e2e tests (if appropriate)
  • 🔖 targeted master branch

Copy link
Member

@aloisklink aloisklink left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

I'm 99.99% sure that the tests are only failing due to #825 (GitHub Actions has recently switched to Ubuntu 24.04 that has stricter security rules by default), so rather than asking you to rebase your PR on master, I'll just merge it and see if it passes on the master branch!

I'm worried thought that #828 might be re-opened, since it sounds like NPM is buggy and will sometimes remove them: npm/cli#4460

Do you think it makes sense to add some sort of CI/linting check to enforce that these fields continue to exist?

I have found https://www.npmjs.com/package/npm-package-lock-add-resolved, which seems to be a Node.JS port of https://github.com/jeslie0/npm-lockfile-fix that might be useful.

@aloisklink aloisklink merged commit b2cd70e into mermaid-js:master Jan 13, 2025
3 of 5 checks passed
@aloisklink aloisklink added dependencies Pull requests that update a dependency file chore labels Jan 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
chore dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Regenerate lock file to get integrity
2 participants