Repository navigation
fix(npm): leave dev-only entries out of the shipped shrinkwrap - #96
Merged
Merged
Conversation
1.22.1 shipped package-lock.json whole as npm-shrinkwrap.json. npm installs every entry a dependency's shrinkwrap lists, dev or not, so the first `npx @oscardvs/zoteus@1.22.1` fetched vitest, typescript, esbuild, eslint and the rest with the server: 278 packages and 228 MB. scripts/shrinkwrap.mjs now writes the lock without the entries flagged dev and without the root's devDependencies. It was checked through npm ci, with a consumer lock that marks the package hasShrinkwrap (the path a registry install takes). The published 1.22.1 reproduces 278 packages and 228 MB there. The pruned file installs 99 packages and 132 MB on Linux, every one at its locked version, with no dev tools. A test checks that the shipped file holds exactly the lock's runtime entries.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
1.22.1 shipped
package-lock.jsonwhole asnpm-shrinkwrap.json. npm installs every entry a dependency's shrinkwrap lists, dev or not. So the firstnpx @oscardvs/zoteus@1.22.1fetched vitest, typescript, esbuild, eslint and the rest with the server: 278 packages and 228 MB. A 1.22.0-style install is about 100 packages and 104 MB.scripts/shrinkwrap.mjsnow writes the lock without the entries flaggeddevand without the root'sdevDependencies.Verification.
npm ciin a consumer whose lock marks the packagehasShrinkwrap: true, which is the reify path a registry install takes. A plain local-tarball install never honours a shrinkwrap.The remaining difference against 1.22.0 on Linux is that npm installs both the glibc and the musl canvas binary: npm 10's lockfile records no
libc. The repository's ownnpm cidoes the same, and on macOS and Windows thecpufield already picks one binary.Checks. A new test in
tests/claude-plugin.test.tschecks that the shipped file holds exactly the lock's runtime entries (19 tests).typecheck:testsand eslint are clean. A 1.22.2 release follows, to move the plugin pin off 1.22.1.