Closed g-ongenae closed 11 months ago
The package-lock.json in the different cannot be updated by usual means
@g-ongenae I don't get why cannot you update them ? It is something we did in the past, right ? Why is it not possible anymore ?
Why is it not possible anymore? - @LeKer29
The configuration of Dependabot has changed. And also the command that used to work don't anymore (e.g. lerna exec -- npm i --package-lock-only
).
But even if it was possible to update them, I think we would ought to remove them, as they are basically a duplication of the root package-lock.json file. Other projects using Lerna and NPM workspace don't have a package-lock.json per package.
Description
$schema
property to lerna.json fileMotivation and Context
The package-lock.json in the different cannot be updated by usual means (NPM or Lerna commands, nor npm-check-updates, nor Dependabot), thus it contains multiple security issues. These security issues are already fixed in the root package-lock.json.
After, thorough investigation, it has been clear that those files should not exist in the first place: NPM workspace requires only one package-lock.json at the root of the workspace.
Consequently, the best solution to ensure the security issues are fixed seems to remove the faulty package-lock.json files.
On a side note, running
lerna repair
triggered the addition of this missing property ($schema
).Types of changes