Reproducible builds: add package-lock to repository

[julienr]

Hello,

First, thanks for a great library !

I was trying to do a custom build of elementUI to fix an issue I was having until the fix is release on elementUI main branch. Unless I missed something, the package-lock.json is not checked in in the repo.

Given that package.json has a lot of dependencies that are just "compatible with version" (e.g. it requires webpack ^4.14.0), this makes build not reproducible as running the build on another machine could pull a different version (e.g. if a dependency has been updated in the meantime).

Accoding to npm docs, it seems to be best practice to commit the package-lock.json to the repo.

Any reason this isn't done here ?

[julienr]

As an example, running npm install on the dev branch fails for me with the following

element (dev) $ npm install
npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
npm ERR! 
npm ERR! While resolving: [email protected]
npm ERR! Found: [email protected]
npm ERR! node_modules/webpack
npm ERR!   dev webpack@"^4.14.0" from the root project
npm ERR!   peer webpack@"^4.0.0 || ^5.0.0" from [email protected]
npm ERR!   node_modules/copy-webpack-plugin
npm ERR!     dev copy-webpack-plugin@"^5.0.0" from the root project
npm ERR!   16 more (css-loader, eslint-loader, file-loader, ...)
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer webpack@"^2.0.0 || ^3.0.0" from [email protected]
npm ERR! node_modules/karma-webpack
npm ERR!   dev karma-webpack@"^3.0.5" from the root project
npm ERR! 
npm ERR! Conflicting peer dependency: [email protected]
npm ERR! node_modules/webpack
npm ERR!   peer webpack@"^2.0.0 || ^3.0.0" from [email protected]
npm ERR!   node_modules/karma-webpack
npm ERR!     dev karma-webpack@"^3.0.5" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! 
npm ERR! For a full report see:
npm ERR! /home/julien/.npm/_logs/2023-02-28T07_06_50_121Z-eresolve-report.txt

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/julien/.npm/_logs/2023-02-28T07_06_50_121Z-debug-0.log
element (dev) $ node --version
v19.7.0

[webvs2]

Are you using a higher version of node? If local is required, switch to 10.12.0

[julienr]

Thanks, I'll try that. I was indeed trying with node 19.

If that works, I'll propose a MR to specify the node version in the engines of package.json as a way to document/enforce this.

[webvs2]

I think it's a good idea

[julienr]

Ah nevermind, there is a yarn.lock lockfile. Then shouldn't make install call yarn instead of npm?