algoan / nestjs-components

A list of useful components for NestJS applications
https://www.algoan.com
254 stars 40 forks source link

[CHORE] Fix project configuration #831

Closed g-ongenae closed 11 months ago

g-ongenae commented 11 months ago

Description

Motivation and Context

The package-lock.json in the different cannot be updated by usual means (NPM or Lerna commands, nor npm-check-updates, nor Dependabot), thus it contains multiple security issues. These security issues are already fixed in the root package-lock.json.

After, thorough investigation, it has been clear that those files should not exist in the first place: NPM workspace requires only one package-lock.json at the root of the workspace.

Consequently, the best solution to ensure the security issues are fixed seems to remove the faulty package-lock.json files.

On a side note, running lerna repair triggered the addition of this missing property ($schema).

Types of changes

LeKer29 commented 11 months ago

The package-lock.json in the different cannot be updated by usual means

@g-ongenae I don't get why cannot you update them ? It is something we did in the past, right ? Why is it not possible anymore ?

g-ongenae commented 11 months ago

Why is it not possible anymore? - @LeKer29

The configuration of Dependabot has changed. And also the command that used to work don't anymore (e.g. lerna exec -- npm i --package-lock-only).

But even if it was possible to update them, I think we would ought to remove them, as they are basically a duplication of the root package-lock.json file. Other projects using Lerna and NPM workspace don't have a package-lock.json per package.