vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-02 09:01:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

build(deps): remove npm shrinkwrap; mirror pnpm lock into transient package locks (#114006)

Browse Source 
* build(deps): remove npm shrinkwrap; mirror pnpm lock into transient package locks

npm 12 removed shrinkwrap (command + tarball/root loading). Delete all 82
committed npm-shrinkwrap.json files and stop publishing lockfiles; keep
pnpm-lock.yaml as the single reviewed dependency boundary. The generator
becomes scripts/generate-npm-package-lock.mjs and feeds plugin bundling via
a transient package-lock.json + npm ci (works on npm 11 and 12). Tarball
validation treats the published 2026.7.2 beta train as a shrinkwrap
transition; self-update npm detection now uses install topology instead of
the shipped shrinkwrap.

* fix(deps): repair lint, deadcode, and test-type lanes for the npm 12 migration

- sort integrity comparisons with an explicit comparator (oxlint)
- keep resolveBunGlobalNodeModules module-local (knip unused-export gate)
- model npm pack --json as npm<=11 array / npm 12 name-keyed object
- default calver destructuring in the tarball test fixture
This commit is contained in:
Peter Steinberger
2026-07-26 01:29:55 -04:00
committed by GitHub
parent e935a008f8
commit f6131a4fbf
152 changed files with 815 additions and 26119 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
scripts/github/dependency-guard.mjs
View File

@@ -58,7 +58,6 @@ const dependencyManifestFields = [
export function isDependencyFile(filename) {
return (
filename.endsWith("package-lock.json") ||
filename.endsWith("npm-shrinkwrap.json") ||
filename.endsWith("pnpm-lock.yaml") ||
filename === "pnpm-workspace.yaml" ||
filename.startsWith("patches/")
@@ -70,11 +69,7 @@ export function isDependencyManifest(filename) {
}
export function isPackageLockfile(filename) {
return (
filename.endsWith("pnpm-lock.yaml") ||
filename.endsWith("package-lock.json") ||
filename.endsWith("npm-shrinkwrap.json")
);
return filename.endsWith("pnpm-lock.yaml") || filename.endsWith("package-lock.json");
}
export function dependencyFieldChanges(baseManifest, headManifest) {
@@ -273,8 +268,8 @@ function renderDependencyAwarenessComment(dependencyFiles) {
"",
"Maintainer follow-up:",
"- Review whether the dependency changes are intentional.",
"- Inspect resolved package deltas when lockfile, shrinkwrap, or workspace dependency policy changes are present.",
"- Treat `package-lock.json` and `npm-shrinkwrap.json` diffs as security-review surfaces.",
"- Inspect resolved package deltas when lockfiles or workspace dependency policy changes are present.",
"- Treat `pnpm-lock.yaml` and `package-lock.json` diffs as dependency security-review surfaces.",
"- Run `pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json` locally for detailed release-style evidence.",
].join("\n");
}