kingchenc
88f119109d
Until now `package-lock.json` was globally ignored. Two practical consequences for the Node binding: - A fresh `git clone && cd bindings/node && npm install` resolved `@napi-rs/cli` and any transitive deps to whatever the npm registry currently considered the latest matching the package.json semver ranges. Contributors could get different dep graphs on different days. - No protection against transitive-dep tampering at install time (lockfile records resolved versions + integrity hashes, npm verifies on subsequent installs). Drop the global `package-lock.json` ignore and commit the freshly generated `bindings/node/package-lock.json` (140 lines, only a couple of direct deps because the binding is small). The `.gitignore` comment notes that we still don't expect lockfiles at the workspace root. No CI workflow changes — the existing `npm install` in the Node-test job will now consume the committed lockfile, which is exactly what we want.
58 lines
740 B
Plaintext
58 lines
740 B
Plaintext
# Rust
|
|
/target/
|
|
**/target/
|
|
Cargo.lock.bak
|
|
*.pdb
|
|
|
|
# Python
|
|
__pycache__/
|
|
*.py[cod]
|
|
*$py.class
|
|
*.so
|
|
*.pyd
|
|
*.egg-info/
|
|
.pytest_cache/
|
|
.venv/
|
|
venv/
|
|
.python-version
|
|
dist/
|
|
build/
|
|
wheels/
|
|
*.whl
|
|
|
|
# Editor / OS
|
|
.idea/
|
|
.vscode/
|
|
*.swp
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# Maturin
|
|
target/wheels/
|
|
|
|
# Benchmarks
|
|
criterion/
|
|
|
|
# Coverage
|
|
*.profraw
|
|
lcov.info
|
|
tarpaulin-report.html
|
|
|
|
# Local config that should not be committed
|
|
*.local.toml
|
|
|
|
# Node binding artifacts
|
|
**/node_modules/
|
|
bindings/node/*.node
|
|
bindings/node/index.d.ts
|
|
bindings/node/npm-debug.log*
|
|
# package-lock.json is committed (under bindings/node/) so contributors
|
|
# get reproducible npm installs. Top-level lockfiles still aren't expected.
|
|
|
|
# WASM build output
|
|
bindings/wasm/pkg/
|
|
|
|
# Python venv
|
|
.venv/
|
|
venv/
|