Fixing an issue where running npm 9 or npm 10 caused a downgrade of the package-lock.json lockfile version when subdependencies were updated. The existing npm version check was specific to npm 8, leading to incorrect behavior for npm >= 9.
This update ensures compatibility for npm versions 8, 9, and 10, treating them equally in the conditional logic for subdependency updates.
Anything you want to highlight for special attention from reviewers?
The logic has been adjusted to include all npm versions >= 8. This required reviewing how the run_npm8_subdependency_update_command method is triggered and modifying the conditional checks to account for npm versions 8, 9, and 10.
Special attention was given to ensure backward compatibility for npm 7, which also uses lockfileVersion: 2.
How will you know you've accomplished your goal?
Reproduction: The issue was reproduced with npm 9 and npm 10, where the lockfile was downgraded during subdependency updates.
Validation: The fix was validated by:
Running the updated logic with npm 8, 9, and 10.
Ensuring that the correct package-lock.json structure (lockfile version 3) is retained.
Running the complete test suite and adding new tests to cover the updated npm version check.
Checklist
[ ] I have run the complete test suite to ensure all tests and linters pass.
[ ] I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
[x] I have written clear and descriptive commit messages.
[x] I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
[x] I have ensured that the code is well-documented and easy to understand.
What are you trying to accomplish?
Fixing an issue where running npm 9 or npm 10 caused a downgrade of the
package-lock.jsonlockfile version when subdependencies were updated. The existing npm version check was specific to npm 8, leading to incorrect behavior for npm >= 9.This update ensures compatibility for npm versions 8, 9, and 10, treating them equally in the conditional logic for subdependency updates.
Bug Issue: dependabot-core/#10982
Anything you want to highlight for special attention from reviewers?
run_npm8_subdependency_update_commandmethod is triggered and modifying the conditional checks to account for npm versions 8, 9, and 10.lockfileVersion: 2.How will you know you've accomplished your goal?
package-lock.jsonstructure (lockfile version 3) is retained.Checklist