From 88f119109d6697879765bb078b0cad802777eb81 Mon Sep 17 00:00:00 2001 From: kingchenc Date: Sat, 30 May 2026 18:24:46 +0200 Subject: [PATCH] chore(node): commit bindings/node/package-lock.json for reproducible installs (#68) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Until now `package-lock.json` was globally ignored. Two practical consequences for the Node binding: - A fresh `git clone && cd bindings/node && npm install` resolved `@napi-rs/cli` and any transitive deps to whatever the npm registry currently considered the latest matching the package.json semver ranges. Contributors could get different dep graphs on different days. - No protection against transitive-dep tampering at install time (lockfile records resolved versions + integrity hashes, npm verifies on subsequent installs). Drop the global `package-lock.json` ignore and commit the freshly generated `bindings/node/package-lock.json` (140 lines, only a couple of direct deps because the binding is small). The `.gitignore` comment notes that we still don't expect lockfiles at the workspace root. No CI workflow changes — the existing `npm install` in the Node-test job will now consume the committed lockfile, which is exactly what we want. --- .gitignore | 3 +- bindings/node/package-lock.json | 140 ++++++++++++++++++++++++++++++++ 2 files changed, 142 insertions(+), 1 deletion(-) create mode 100644 bindings/node/package-lock.json diff --git a/.gitignore b/.gitignore index c47915a5..84428472 100644 --- a/.gitignore +++ b/.gitignore @@ -46,7 +46,8 @@ tarpaulin-report.html bindings/node/*.node bindings/node/index.d.ts bindings/node/npm-debug.log* -package-lock.json +# package-lock.json is committed (under bindings/node/) so contributors +# get reproducible npm installs. Top-level lockfiles still aren't expected. # WASM build output bindings/wasm/pkg/ diff --git a/bindings/node/package-lock.json b/bindings/node/package-lock.json new file mode 100644 index 00000000..d0cfc37c --- /dev/null +++ b/bindings/node/package-lock.json @@ -0,0 +1,140 @@ +{ + "name": "wickra", + "version": "0.2.7", + "lockfileVersion": 3, + "requires": true, + "packages": { + "": { + "name": "wickra", + "version": "0.2.7", + "license": "PolyForm-Noncommercial-1.0.0", + "devDependencies": { + "@napi-rs/cli": "^2.18.0" + }, + "engines": { + "node": ">= 18" + }, + "optionalDependencies": { + "wickra-darwin-arm64": "0.2.7", + "wickra-darwin-x64": "0.2.7", + "wickra-linux-arm64-gnu": "0.2.7", + "wickra-linux-x64-gnu": "0.2.7", + "wickra-win32-arm64-msvc": "0.2.7", + "wickra-win32-x64-msvc": "0.2.7" + } + }, + "node_modules/@napi-rs/cli": { + "version": "2.18.4", + "resolved": "https://registry.npmjs.org/@napi-rs/cli/-/cli-2.18.4.tgz", + "integrity": "sha512-SgJeA4df9DE2iAEpr3M2H0OKl/yjtg1BnRI5/JyowS71tUWhrfSu2LT0V3vlHET+g1hBVlrO60PmEXwUEKp8Mg==", + "dev": true, + "license": "MIT", + "bin": { + "napi": "scripts/index.js" + }, + "engines": { + "node": ">= 10" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/Brooooooklyn" + } + }, + "node_modules/wickra-darwin-arm64": { + "version": "0.2.7", + "resolved": "https://registry.npmjs.org/wickra-darwin-arm64/-/wickra-darwin-arm64-0.2.7.tgz", + "integrity": "sha512-4eZiBR/yGUdr4nzhEUFy2i69XgNx64iI2ax/LPamsThgylC0KpHOZKK19QzJ2d9KbK4C8nMjME5FLuR+4GNEwQ==", + "cpu": [ + "arm64" + ], + "license": "PolyForm-Noncommercial-1.0.0", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">= 18" + } + }, + "node_modules/wickra-darwin-x64": { + "version": "0.2.7", + "resolved": "https://registry.npmjs.org/wickra-darwin-x64/-/wickra-darwin-x64-0.2.7.tgz", + "integrity": "sha512-6hf8zI3QPjTFp4zCpmgUwDvNtu6jHqNUHKD5e55POo0CgA52HkpyxSPtVm8TGTIZDI7kPjlbOdBM8CJ76mmXwA==", + "cpu": [ + "x64" + ], + "license": "PolyForm-Noncommercial-1.0.0", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">= 18" + } + }, + "node_modules/wickra-linux-arm64-gnu": { + "version": "0.2.7", + "resolved": "https://registry.npmjs.org/wickra-linux-arm64-gnu/-/wickra-linux-arm64-gnu-0.2.7.tgz", + "integrity": "sha512-kSe6y0xBMSiqdPLXNjwop5WZdHtvdBNKSEBCwZ4hFq33p4apW25/wrlzv9/oDuyD4kuPabJEhCCnFOplh58CUg==", + "cpu": [ + "arm64" + ], + "license": "PolyForm-Noncommercial-1.0.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 18" + } + }, + "node_modules/wickra-linux-x64-gnu": { + "version": "0.2.7", + "resolved": "https://registry.npmjs.org/wickra-linux-x64-gnu/-/wickra-linux-x64-gnu-0.2.7.tgz", + "integrity": "sha512-tWBWS4qz7hxM4xnpFb59bhf6TaLwXq0Z3jEa/2l7r8PiHA94g8r8S53NRMiT+4yiL5hSWe/nUiC/YXdRrhEZ4g==", + "cpu": [ + "x64" + ], + "license": "PolyForm-Noncommercial-1.0.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 18" + } + }, + "node_modules/wickra-win32-arm64-msvc": { + "version": "0.2.7", + "resolved": "https://registry.npmjs.org/wickra-win32-arm64-msvc/-/wickra-win32-arm64-msvc-0.2.7.tgz", + "integrity": "sha512-EXIckHxAtF75PUGDKRzXyqMe9ldP0JjSdu68WFN6iJfp+McYrGu6h40TEJlQ/oUEIoPqiZB/xhVyo/el5Lg7zw==", + "cpu": [ + "arm64" + ], + "license": "PolyForm-Noncommercial-1.0.0", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">= 18" + } + }, + "node_modules/wickra-win32-x64-msvc": { + "version": "0.2.7", + "resolved": "https://registry.npmjs.org/wickra-win32-x64-msvc/-/wickra-win32-x64-msvc-0.2.7.tgz", + "integrity": "sha512-Yfsqq1Xwp6hdxMyLze411vNdo7BDwI6+lPSe7A9XdqyPecNDbtKwYLpsal2r8EHbNzqM+R8XnuRtUaEQS5VlUQ==", + "cpu": [ + "x64" + ], + "license": "PolyForm-Noncommercial-1.0.0", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">= 18" + } + } + } +}