Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CHORE] Fix project configuration #831

Merged
merged 2 commits into from
Dec 11, 2023

Conversation

g-ongenae
Copy link
Member

Description

  • Remove package-lock.json of packages
  • Add missing $schema property to lerna.json file

Motivation and Context

The package-lock.json in the different cannot be updated by usual means (NPM or Lerna commands, nor npm-check-updates, nor Dependabot), thus it contains multiple security issues. These security issues are already fixed in the root package-lock.json.

After, thorough investigation, it has been clear that those files should not exist in the first place: NPM workspace requires only one package-lock.json at the root of the workspace.

Consequently, the best solution to ensure the security issues are fixed seems to remove the faulty package-lock.json files.

On a side note, running lerna repair triggered the addition of this missing property ($schema).

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

@g-ongenae g-ongenae added the bug Something isn't working label Dec 11, 2023
@g-ongenae g-ongenae self-assigned this Dec 11, 2023
@LeKer29
Copy link
Contributor

LeKer29 commented Dec 11, 2023

The package-lock.json in the different cannot be updated by usual means

@g-ongenae I don't get why cannot you update them ? It is something we did in the past, right ? Why is it not possible anymore ?

@g-ongenae
Copy link
Member Author

g-ongenae commented Dec 11, 2023

Why is it not possible anymore? - @LeKer29

The configuration of Dependabot has changed. And also the command that used to work don't anymore (e.g. lerna exec -- npm i --package-lock-only).

But even if it was possible to update them, I think we would ought to remove them, as they are basically a duplication of the root package-lock.json file. Other projects using Lerna and NPM workspace don't have a package-lock.json per package.

@g-ongenae g-ongenae merged commit fb571fe into algoan:master Dec 11, 2023
4 checks passed
@g-ongenae g-ongenae deleted the chore/update-deps branch December 11, 2023 09:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants