From 02e1ee85dee8879f18875f949dab514cad74ef94 Mon Sep 17 00:00:00 2001 From: d3xter666 Date: Thu, 27 Aug 2026 18:29:10 +0300 Subject: [PATCH 01/11] refactor(lockfile-extractor): Rename from shrinkwrap-extractor --- .../LICENSES/Apache-2.0.txt | 0 .../REUSE.toml | 0 .../cli.js | 22 +-- .../eslint.config.js | 0 .../lib/extractFromWorkspaceLockfile.js} | 12 +- .../package.json | 17 ++- .../expected/package.a/package-lock.json} | 0 .../expected/package.b/package-lock.json} | 0 .../package-lock.fixture.json | 0 .../malformed/package-lock.fixture.json | 0 .../no-packages/package-lock.fixture.json | 0 .../invalid/v2/package-lock.fixture.json | 0 .../project.a/package-lock.fixture.json | 0 .../project.b/package-lock.fixture.json | 0 .../test/lib/extractFromWorkspaceLockfile.js} | 134 +++++++++--------- 15 files changed, 92 insertions(+), 93 deletions(-) rename internal/{shrinkwrap-extractor => lockfile-extractor}/LICENSES/Apache-2.0.txt (100%) rename internal/{shrinkwrap-extractor => lockfile-extractor}/REUSE.toml (100%) rename internal/{shrinkwrap-extractor => lockfile-extractor}/cli.js (64%) rename internal/{shrinkwrap-extractor => lockfile-extractor}/eslint.config.js (100%) rename internal/{shrinkwrap-extractor/lib/convertPackageLockToShrinkwrap.js => lockfile-extractor/lib/extractFromWorkspaceLockfile.js} (95%) rename internal/{shrinkwrap-extractor => lockfile-extractor}/package.json (61%) rename internal/{shrinkwrap-extractor/test/expected/package.a/npm-shrinkwrap.json => lockfile-extractor/test/expected/package.a/package-lock.json} (100%) rename internal/{shrinkwrap-extractor/test/expected/package.b/npm-shrinkwrap.json => lockfile-extractor/test/expected/package.b/package-lock.json} (100%) rename internal/{shrinkwrap-extractor => lockfile-extractor}/test/fixture/invalid/invalid-packages/package-lock.fixture.json (100%) rename internal/{shrinkwrap-extractor => lockfile-extractor}/test/fixture/invalid/malformed/package-lock.fixture.json (100%) rename internal/{shrinkwrap-extractor => lockfile-extractor}/test/fixture/invalid/no-packages/package-lock.fixture.json (100%) rename internal/{shrinkwrap-extractor => lockfile-extractor}/test/fixture/invalid/v2/package-lock.fixture.json (100%) rename internal/{shrinkwrap-extractor => lockfile-extractor}/test/fixture/project.a/package-lock.fixture.json (100%) rename internal/{shrinkwrap-extractor => lockfile-extractor}/test/fixture/project.b/package-lock.fixture.json (100%) rename internal/{shrinkwrap-extractor/test/lib/convertToShrinkwrap.js => lockfile-extractor/test/lib/extractFromWorkspaceLockfile.js} (65%) diff --git a/internal/shrinkwrap-extractor/LICENSES/Apache-2.0.txt b/internal/lockfile-extractor/LICENSES/Apache-2.0.txt similarity index 100% rename from internal/shrinkwrap-extractor/LICENSES/Apache-2.0.txt rename to internal/lockfile-extractor/LICENSES/Apache-2.0.txt diff --git a/internal/shrinkwrap-extractor/REUSE.toml b/internal/lockfile-extractor/REUSE.toml similarity index 100% rename from internal/shrinkwrap-extractor/REUSE.toml rename to internal/lockfile-extractor/REUSE.toml diff --git a/internal/shrinkwrap-extractor/cli.js b/internal/lockfile-extractor/cli.js similarity index 64% rename from internal/shrinkwrap-extractor/cli.js rename to internal/lockfile-extractor/cli.js index 9604ba697fc..d0783efc0fd 100755 --- a/internal/shrinkwrap-extractor/cli.js +++ b/internal/lockfile-extractor/cli.js @@ -2,7 +2,7 @@ import {readFile, writeFile} from "node:fs/promises"; import {join} from "node:path"; -import convertPackageLockToShrinkwrap from "./lib/convertPackageLockToShrinkwrap.js"; +import extractFromWorkspaceLockfile from "./lib/extractFromWorkspaceLockfile.js"; async function main() { const args = process.argv.slice(2); @@ -10,14 +10,14 @@ async function main() { // Validate arguments if (args.length !== 1) { console.error("Error: Expected exactly 1 argument"); - console.error("Usage: shrinkwrap-extractor "); + console.error("Usage: lockfile-extractor "); process.exit(1); } const [workspaceRootPath] = args; try { - console.log(`Generating shrinkwrap in: ${process.cwd()}`); + console.log(`Generating lockfile in: ${process.cwd()}`); console.log(`Using workspace root: ${workspaceRootPath}`); // Read and parse package.json @@ -33,17 +33,17 @@ async function main() { console.log(`Converting dependencies for package: ${packageName}`); - // Extract into shrinkwrap - const shrinkwrap = await convertPackageLockToShrinkwrap(workspaceRootPath, packageName); + // Extract into lockfile + const lockfile = await extractFromWorkspaceLockfile(workspaceRootPath, packageName); - // Write npm-shrinkwrap.json to current working directory - const outputPath = join(process.cwd(), "npm-shrinkwrap.json"); - const shrinkwrapContent = JSON.stringify(shrinkwrap, null, "\t"); + // Write package-lock.json to current working directory + const outputPath = join(process.cwd(), "package-lock.json"); + const lockfileContent = JSON.stringify(lockfile, null, "\t"); - await writeFile(outputPath, shrinkwrapContent, "utf-8"); + await writeFile(outputPath, lockfileContent, "utf-8"); - console.log(`Successfully generated npm-shrinkwrap.json with ` + - `${Object.keys(shrinkwrap.packages).length - 1} dependencies (excluding root)`); + console.log(`Successfully generated package-lock.json with ` + + `${Object.keys(lockfile.packages).length - 1} dependencies (excluding root)`); console.log(`Output written to: ${outputPath}`); } catch (error) { console.error(`Unexpected error: ${error.message}`); diff --git a/internal/shrinkwrap-extractor/eslint.config.js b/internal/lockfile-extractor/eslint.config.js similarity index 100% rename from internal/shrinkwrap-extractor/eslint.config.js rename to internal/lockfile-extractor/eslint.config.js diff --git a/internal/shrinkwrap-extractor/lib/convertPackageLockToShrinkwrap.js b/internal/lockfile-extractor/lib/extractFromWorkspaceLockfile.js similarity index 95% rename from internal/shrinkwrap-extractor/lib/convertPackageLockToShrinkwrap.js rename to internal/lockfile-extractor/lib/extractFromWorkspaceLockfile.js index 2493f16c5ca..a6bb88a4222 100644 --- a/internal/shrinkwrap-extractor/lib/convertPackageLockToShrinkwrap.js +++ b/internal/lockfile-extractor/lib/extractFromWorkspaceLockfile.js @@ -11,7 +11,7 @@ async function readJson(filePath) { return JSON.parse(jsonString); } -export default async function convertPackageLockToShrinkwrap(workspaceRootDir, targetPackageName) { +export default async function extractFromWorkspaceLockfile(workspaceRootDir, targetPackageName) { const packageLockJson = await readJson(path.join(workspaceRootDir, "package-lock.json")); // Input validation @@ -92,8 +92,8 @@ export default async function convertPackageLockToShrinkwrap(workspaceRootDir, t sortedExtractedPackages[key] = extractedPackages[key]; } - // Generate npm-shrinkwrap.json - const shrinkwrap = { + // Generate package-lock.json + const lockfile = { name: targetPackageName, version: cliNode.version, lockfileVersion: 3, @@ -101,7 +101,7 @@ export default async function convertPackageLockToShrinkwrap(workspaceRootDir, t packages: sortedExtractedPackages }; - return shrinkwrap; + return lockfile; } /** @@ -112,9 +112,9 @@ export default async function convertPackageLockToShrinkwrap(workspaceRootDir, t * * @param {string} location - Package location from arborist * @param {object} node - Package node from arborist - * @param {string} targetPackageName - Target package name for shrinkwrap file + * @param {string} targetPackageName - Target package name for lockfile file * @param {string} rootPackageName - Root / workspace package name - * @returns {string} - Normalized location for npm-shrinkwrap.json + * @returns {string} - Normalized location for package-lock.json */ function normalizePackageLocation(location, node, targetPackageName, rootPackageName) { const topPackageName = node.top.packageName; diff --git a/internal/shrinkwrap-extractor/package.json b/internal/lockfile-extractor/package.json similarity index 61% rename from internal/shrinkwrap-extractor/package.json rename to internal/lockfile-extractor/package.json index 15ad209d292..4a85b5c74bd 100644 --- a/internal/shrinkwrap-extractor/package.json +++ b/internal/lockfile-extractor/package.json @@ -1,33 +1,32 @@ { - "name": "@ui5/shrinkwrap-extractor", + "name": "@ui5/lockfile-extractor", "version": "1.0.0", "private": true, - "description": "Convert npm package-lock.json files to npm-shrinkwrap.json format for specific packages in monorepos", + "description": "Extract a standalone package-lock.json for a specific package from a monorepo workspace", "author": { "name": "SAP SE", "email": "openui5@sap.com", "url": "https://www.sap.com" }, "license": "Apache-2.0", - "main": "lib/convertPackageLockToShrinkwrap.js", + "main": "lib/extractFromWorkspaceLockfile.js", "bin": { - "shrinkwrap-extractor": "cli.js" + "lockfile-extractor": "cli.js" }, "repository": { "type": "git", "url": "git+ssh://git@github.com/UI5/cli.git", - "directory": "internal/shrinkwrap-extractor" + "directory": "internal/lockfile-extractor" }, "scripts": { "test": "npm run lint && npm run coverage", - "unit": "node --test test/lib/convertToShrinkwrap.js", - "unit-watch": "node --test --watch test/lib/convertToShrinkwrap.js", - "coverage": "node --test --experimental-test-coverage 'test/lib/convertToShrinkwrap.js'", + "unit": "node --test test/lib/extractFromWorkspaceLockfile.js", + "unit-watch": "node --test --watch test/lib/extractFromWorkspaceLockfile.js", + "coverage": "node --test --experimental-test-coverage 'test/lib/extractFromWorkspaceLockfile.js'", "lint": "eslint ." }, "keywords": [ "npm", - "shrinkwrap", "package-lock", "monorepo", "dependencies" diff --git a/internal/shrinkwrap-extractor/test/expected/package.a/npm-shrinkwrap.json b/internal/lockfile-extractor/test/expected/package.a/package-lock.json similarity index 100% rename from internal/shrinkwrap-extractor/test/expected/package.a/npm-shrinkwrap.json rename to internal/lockfile-extractor/test/expected/package.a/package-lock.json diff --git a/internal/shrinkwrap-extractor/test/expected/package.b/npm-shrinkwrap.json b/internal/lockfile-extractor/test/expected/package.b/package-lock.json similarity index 100% rename from internal/shrinkwrap-extractor/test/expected/package.b/npm-shrinkwrap.json rename to internal/lockfile-extractor/test/expected/package.b/package-lock.json diff --git a/internal/shrinkwrap-extractor/test/fixture/invalid/invalid-packages/package-lock.fixture.json b/internal/lockfile-extractor/test/fixture/invalid/invalid-packages/package-lock.fixture.json similarity index 100% rename from internal/shrinkwrap-extractor/test/fixture/invalid/invalid-packages/package-lock.fixture.json rename to internal/lockfile-extractor/test/fixture/invalid/invalid-packages/package-lock.fixture.json diff --git a/internal/shrinkwrap-extractor/test/fixture/invalid/malformed/package-lock.fixture.json b/internal/lockfile-extractor/test/fixture/invalid/malformed/package-lock.fixture.json similarity index 100% rename from internal/shrinkwrap-extractor/test/fixture/invalid/malformed/package-lock.fixture.json rename to internal/lockfile-extractor/test/fixture/invalid/malformed/package-lock.fixture.json diff --git a/internal/shrinkwrap-extractor/test/fixture/invalid/no-packages/package-lock.fixture.json b/internal/lockfile-extractor/test/fixture/invalid/no-packages/package-lock.fixture.json similarity index 100% rename from internal/shrinkwrap-extractor/test/fixture/invalid/no-packages/package-lock.fixture.json rename to internal/lockfile-extractor/test/fixture/invalid/no-packages/package-lock.fixture.json diff --git a/internal/shrinkwrap-extractor/test/fixture/invalid/v2/package-lock.fixture.json b/internal/lockfile-extractor/test/fixture/invalid/v2/package-lock.fixture.json similarity index 100% rename from internal/shrinkwrap-extractor/test/fixture/invalid/v2/package-lock.fixture.json rename to internal/lockfile-extractor/test/fixture/invalid/v2/package-lock.fixture.json diff --git a/internal/shrinkwrap-extractor/test/fixture/project.a/package-lock.fixture.json b/internal/lockfile-extractor/test/fixture/project.a/package-lock.fixture.json similarity index 100% rename from internal/shrinkwrap-extractor/test/fixture/project.a/package-lock.fixture.json rename to internal/lockfile-extractor/test/fixture/project.a/package-lock.fixture.json diff --git a/internal/shrinkwrap-extractor/test/fixture/project.b/package-lock.fixture.json b/internal/lockfile-extractor/test/fixture/project.b/package-lock.fixture.json similarity index 100% rename from internal/shrinkwrap-extractor/test/fixture/project.b/package-lock.fixture.json rename to internal/lockfile-extractor/test/fixture/project.b/package-lock.fixture.json diff --git a/internal/shrinkwrap-extractor/test/lib/convertToShrinkwrap.js b/internal/lockfile-extractor/test/lib/extractFromWorkspaceLockfile.js similarity index 65% rename from internal/shrinkwrap-extractor/test/lib/convertToShrinkwrap.js rename to internal/lockfile-extractor/test/lib/extractFromWorkspaceLockfile.js index 2f9ea90d476..0086321fcac 100644 --- a/internal/shrinkwrap-extractor/test/lib/convertToShrinkwrap.js +++ b/internal/lockfile-extractor/test/lib/extractFromWorkspaceLockfile.js @@ -1,6 +1,6 @@ import path from "node:path"; import {readFile, mkdir, writeFile, unlink, symlink} from "node:fs/promises"; -import convertPackageLockToShrinkwrap from "../../lib/convertPackageLockToShrinkwrap.js"; +import extractFromWorkspaceLockfile from "../../lib/extractFromWorkspaceLockfile.js"; import {test} from "node:test"; import assert from "node:assert"; import {mock} from "node:test"; @@ -32,7 +32,7 @@ async function setupFixtureSymlink(fixtureDir) { return symlinkPath; } -test("Convert package-lock.json to shrinkwrap", async (t) => { +test("Convert package-lock.json to lockfile", async (t) => { const __dirname = import.meta.dirname; const cwd = path.join(__dirname, "..", "fixture", "project.a"); @@ -40,24 +40,24 @@ test("Convert package-lock.json to shrinkwrap", async (t) => { t.after(async () => await unlink(symlinkPath).catch(() => {})); const targetPackageName = "@ui5/cli"; - const shrinkwrapJson = await convertPackageLockToShrinkwrap(cwd, targetPackageName); + const lockfileJson = await extractFromWorkspaceLockfile(cwd, targetPackageName); // Basic structure validation - assert.equal(shrinkwrapJson.name, "@ui5/cli"); - assert.equal(shrinkwrapJson.version, "4.0.34"); - assert.equal(shrinkwrapJson.lockfileVersion, 3); - assert.equal(shrinkwrapJson.requires, true); - assert.ok(shrinkwrapJson.packages); + assert.equal(lockfileJson.name, "@ui5/cli"); + assert.equal(lockfileJson.version, "4.0.34"); + assert.equal(lockfileJson.lockfileVersion, 3); + assert.equal(lockfileJson.requires, true); + assert.ok(lockfileJson.packages); // Verify root package entry - const rootPackage = shrinkwrapJson.packages[""]; + const rootPackage = lockfileJson.packages[""]; assert.ok(rootPackage); assert.equal(rootPackage.name, "@ui5/cli"); assert.equal(rootPackage.version, "4.0.34"); assert.ok(rootPackage.dependencies); // Verify workspace packages are resolved to registry-like URLs - const builderDep = shrinkwrapJson.packages["node_modules/@ui5/builder"]; + const builderDep = lockfileJson.packages["node_modules/@ui5/builder"]; assert.ok(builderDep?.resolved, "Builder dependency should have a resolved URL"); assert.equal(builderDep.version, "4.1.1"); assert.ok(builderDep.resolved.startsWith("https://registry.npmjs.org/")); @@ -67,21 +67,21 @@ test("Convert package-lock.json to shrinkwrap", async (t) => { assert.ok(builderDep.integrity, "Builder dependency should have integrity from registry"); // Verify regular dependencies have proper structure - const chalkDep = shrinkwrapJson.packages["node_modules/chalk"]; + const chalkDep = lockfileJson.packages["node_modules/chalk"]; assert.ok(chalkDep); assert.equal(chalkDep.version, "5.6.2"); - const yargsDep = shrinkwrapJson.packages["node_modules/yargs"]; + const yargsDep = lockfileJson.packages["node_modules/yargs"]; assert.ok(yargsDep); assert.equal(yargsDep.version, "17.7.2"); // Verify only production dependencies are included (no devDependencies) - const packagePaths = Object.keys(shrinkwrapJson.packages); + const packagePaths = Object.keys(lockfileJson.packages); assert.ok(packagePaths.includes("node_modules/@ui5/builder")); assert.ok(packagePaths.includes("node_modules/chalk")); assert.ok(packagePaths.includes("node_modules/semver")); assert.ok(!packagePaths.includes("node_modules/@eslint/js")); - console.log(`Generated shrinkwrap with ${packagePaths.length - 1} dependencies`); + console.log(`Generated lockfile with ${packagePaths.length - 1} dependencies`); }); test("Workspace paths should be normalized to node_modules format", async (t) => { @@ -92,10 +92,10 @@ test("Workspace paths should be normalized to node_modules format", async (t) => t.after(async () => await unlink(symlinkPath).catch(() => {})); const targetPackageName = "@ui5/cli"; - const shrinkwrapJson = await convertPackageLockToShrinkwrap(cwd, targetPackageName); + const lockfileJson = await extractFromWorkspaceLockfile(cwd, targetPackageName); // Verify that no package paths contain workspace prefixes like "packages/cli/node_modules/..." - const packagePaths = Object.keys(shrinkwrapJson.packages); + const packagePaths = Object.keys(lockfileJson.packages); for (const packagePath of packagePaths) { // Skip root package (empty string) @@ -112,96 +112,96 @@ test("Workspace paths should be normalized to node_modules format", async (t) => // Specifically check a package that would have been under packages/cli/node_modules in the monorepo // The "@npmcli/config" package is a direct dependency that exists in the CLI's node_modules - const npmCliConfigPackage = shrinkwrapJson.packages["node_modules/@npmcli/config"]; + const npmCliConfigPackage = lockfileJson.packages["node_modules/@npmcli/config"]; assert.ok(npmCliConfigPackage, "The '@npmcli/config' package should be present at normalized path"); assert.equal(npmCliConfigPackage.version, "9.0.0", "@npmcli/config package should have correct version"); console.log(`✓ All ${packagePaths.length - 1} package paths correctly normalized`); }); -test("Compare generated shrinkwrap with expected result", async (t) => { +test("Compare generated lockfile with expected result", async (t) => { // Setup mock to prevent actual npm registry requests const mockRestore = setupPacoteMock(); t.after(() => mockRestore()); const __dirname = import.meta.dirname; - const generatedShrinkwrapPath = path.join(__dirname, "..", "tmp", "package.a", "npm-shrinkwrap.generated.json"); + const generatedLockfilePath = path.join(__dirname, "..", "tmp", "package.a", "package-lock.generated.json"); // Clean any existing generated file - await mkdir(path.dirname(generatedShrinkwrapPath), {recursive: true}); - await unlink(generatedShrinkwrapPath).catch(() => {}); + await mkdir(path.dirname(generatedLockfilePath), {recursive: true}); + await unlink(generatedLockfilePath).catch(() => {}); - // Generate shrinkwrap from fixture + // Generate lockfile from fixture const cwd = path.join(__dirname, "..", "fixture", "project.a"); const symlinkPath = await setupFixtureSymlink(cwd); t.after(async () => await unlink(symlinkPath).catch(() => {})); const targetPackageName = "@ui5/cli"; - const generatedShrinkwrap = await convertPackageLockToShrinkwrap(cwd, targetPackageName); + const generatedLockfile = await extractFromWorkspaceLockfile(cwd, targetPackageName); - // Load expected shrinkwrap - const expectedShrinkwrapPath = path.join(__dirname, "..", "expected", "package.a", "npm-shrinkwrap.json"); - const expectedShrinkwrap = await readJson(expectedShrinkwrapPath); + // Load expected lockfile + const expectedLockfilePath = path.join(__dirname, "..", "expected", "package.a", "package-lock.json"); + const expectedLockfile = await readJson(expectedLockfilePath); - // Write generated shrinkwrap to tmp dir for debugging purposes - await writeFile(generatedShrinkwrapPath, JSON.stringify(generatedShrinkwrap, null, "\t"), "utf-8"); + // Write generated lockfile to tmp dir for debugging purposes + await writeFile(generatedLockfilePath, JSON.stringify(generatedLockfile, null, "\t"), "utf-8"); // Compare top-level properties console.log("=== TOP-LEVEL COMPARISON ==="); - console.log(`Generated name: ${generatedShrinkwrap.name}, Expected name: ${expectedShrinkwrap.name}`); - console.log(`Generated version: ${generatedShrinkwrap.version}, Expected version: ${expectedShrinkwrap.version}`); - console.log(`Generated lockfileVersion: ${generatedShrinkwrap.lockfileVersion},` + - ` Expected lockfileVersion: ${expectedShrinkwrap.lockfileVersion}`); - console.log(`Generated requires: ${generatedShrinkwrap.requires}, ` + - `Expected requires: ${expectedShrinkwrap.requires}`); + console.log(`Generated name: ${generatedLockfile.name}, Expected name: ${expectedLockfile.name}`); + console.log(`Generated version: ${generatedLockfile.version}, Expected version: ${expectedLockfile.version}`); + console.log(`Generated lockfileVersion: ${generatedLockfile.lockfileVersion},` + + ` Expected lockfileVersion: ${expectedLockfile.lockfileVersion}`); + console.log(`Generated requires: ${generatedLockfile.requires}, ` + + `Expected requires: ${expectedLockfile.requires}`); // Compare root package entries console.log("\n=== ROOT PACKAGE COMPARISON ==="); - const generatedRoot = generatedShrinkwrap.packages[""]; - const expectedRoot = expectedShrinkwrap.packages[""]; + const generatedRoot = generatedLockfile.packages[""]; + const expectedRoot = expectedLockfile.packages[""]; console.log(`Generated root keys: ${Object.keys(generatedRoot).sort().join(", ")}`); console.log(`Expected root keys: ${Object.keys(expectedRoot).sort().join(", ")}`); // Compare package counts console.log("\n=== PACKAGE COUNT COMPARISON ==="); - const generatedPackageKeys = Object.keys(generatedShrinkwrap.packages); - const expectedPackageKeys = Object.keys(expectedShrinkwrap.packages); + const generatedPackageKeys = Object.keys(generatedLockfile.packages); + const expectedPackageKeys = Object.keys(expectedLockfile.packages); console.log(`Generated packages: ${generatedPackageKeys.length}`); console.log(`Expected packages: ${expectedPackageKeys.length}`); - assert.deepEqual(generatedShrinkwrap.packages, expectedShrinkwrap.packages, - "Generated shrinkwrap packages should match expected"); + assert.deepEqual(generatedLockfile.packages, expectedLockfile.packages, + "Generated lockfile packages should match expected"); }); -test("Compare generated shrinkwrap with expected result", async (t) => { +test("Compare generated lockfile with expected result", async (t) => { // Setup mock to prevent actual npm registry requests const mockRestore = setupPacoteMock(); t.after(() => mockRestore()); const __dirname = import.meta.dirname; - const generatedShrinkwrapPath = path.join(__dirname, "..", "tmp", "package.b", "npm-shrinkwrap.generated.json"); + const generatedLockfilePath = path.join(__dirname, "..", "tmp", "package.b", "package-lock.generated.json"); // Clean any existing generated file - await mkdir(path.dirname(generatedShrinkwrapPath), {recursive: true}); - await unlink(generatedShrinkwrapPath).catch(() => {}); + await mkdir(path.dirname(generatedLockfilePath), {recursive: true}); + await unlink(generatedLockfilePath).catch(() => {}); - // Generate shrinkwrap from fixture + // Generate lockfile from fixture const cwd = path.join(__dirname, "..", "fixture", "project.b"); const symlinkPath = await setupFixtureSymlink(cwd); t.after(async () => await unlink(symlinkPath).catch(() => {})); const targetPackageName = "@ui5/cli"; - const generatedShrinkwrap = await convertPackageLockToShrinkwrap(cwd, targetPackageName); + const generatedLockfile = await extractFromWorkspaceLockfile(cwd, targetPackageName); - // Load expected shrinkwrap - const expectedShrinkwrapPath = path.join(__dirname, "..", "expected", "package.b", "npm-shrinkwrap.json"); - const expectedShrinkwrap = await readJson(expectedShrinkwrapPath); + // Load expected lockfile + const expectedLockfilePath = path.join(__dirname, "..", "expected", "package.b", "package-lock.json"); + const expectedLockfile = await readJson(expectedLockfilePath); - // Write generated shrinkwrap to tmp dir for debugging purposes - await writeFile(generatedShrinkwrapPath, JSON.stringify(generatedShrinkwrap, null, "\t"), "utf-8"); + // Write generated lockfile to tmp dir for debugging purposes + await writeFile(generatedLockfilePath, JSON.stringify(generatedLockfile, null, "\t"), "utf-8"); - assert.deepEqual(generatedShrinkwrap.packages, expectedShrinkwrap.packages, - "Generated shrinkwrap packages should match expected"); + assert.deepEqual(generatedLockfile.packages, expectedLockfile.packages, + "Generated lockfile packages should match expected"); }); test("Optional peer dependencies with null edges should be excluded", async (t) => { @@ -214,16 +214,16 @@ test("Optional peer dependencies with null edges should be excluded", async (t) const symlinkPath = await setupFixtureSymlink(cwd); t.after(async () => await unlink(symlinkPath).catch(() => {})); - const shrinkwrapJson = await convertPackageLockToShrinkwrap(cwd, "@ui5/cli"); + const lockfileJson = await extractFromWorkspaceLockfile(cwd, "@ui5/cli"); // ws itself must be present (it is a real production dep of @ui5/server) - assert.ok(shrinkwrapJson.packages["node_modules/ws"], - "ws should be included in the shrinkwrap"); + assert.ok(lockfileJson.packages["node_modules/ws"], + "ws should be included in the lockfile"); // Its optional peer deps are not installed and must NOT appear - assert.equal(shrinkwrapJson.packages["node_modules/bufferutil"], undefined, + assert.equal(lockfileJson.packages["node_modules/bufferutil"], undefined, "bufferutil (optional peerDep of ws) must not be included"); - assert.equal(shrinkwrapJson.packages["node_modules/utf-8-validate"], undefined, + assert.equal(lockfileJson.packages["node_modules/utf-8-validate"], undefined, "utf-8-validate (optional peerDep of ws) must not be included"); }); @@ -235,17 +235,17 @@ test("Error handling - invalid target package name", async (t) => { t.after(async () => await unlink(symlinkPath).catch(() => {})); await assert.rejects( - convertPackageLockToShrinkwrap(validCwd, null), + extractFromWorkspaceLockfile(validCwd, null), /Invalid target package name: must be a non-empty string/ ); await assert.rejects( - convertPackageLockToShrinkwrap(validCwd, ""), + extractFromWorkspaceLockfile(validCwd, ""), /Invalid target package name: must be a non-empty string/ ); await assert.rejects( - convertPackageLockToShrinkwrap(validCwd, " "), + extractFromWorkspaceLockfile(validCwd, " "), /Invalid target package name: must be a non-empty string/ ); }); @@ -257,14 +257,14 @@ test("Error handling - target package not found", async (t) => { t.after(async () => await unlink(symlinkPath).catch(() => {})); await assert.rejects( - convertPackageLockToShrinkwrap(validCwd, "non-existent-package"), + extractFromWorkspaceLockfile(validCwd, "non-existent-package"), /Target package "non-existent-package" not found in workspace/ ); }); test("Error handling - invalid workspace directory", async (t) => { await assert.rejects( - convertPackageLockToShrinkwrap("/non/existent/path", "@ui5/cli"), + extractFromWorkspaceLockfile("/non/existent/path", "@ui5/cli"), /ENOENT.*package-lock\.json/ ); }); @@ -292,25 +292,25 @@ test("Error handling - invalid package-lock.json files", async (t) => { // Test malformed JSON await assert.rejects( - convertPackageLockToShrinkwrap(malformedDir, "@ui5/cli"), + extractFromWorkspaceLockfile(malformedDir, "@ui5/cli"), /Unexpected token/ ); // Test missing packages field await assert.rejects( - convertPackageLockToShrinkwrap(noPackagesDir, "@ui5/cli"), + extractFromWorkspaceLockfile(noPackagesDir, "@ui5/cli"), /Invalid package-lock\.json: missing packages field/ ); // Test invalid packages field await assert.rejects( - convertPackageLockToShrinkwrap(invalidPackagesDir, "@ui5/cli"), + extractFromWorkspaceLockfile(invalidPackagesDir, "@ui5/cli"), /Invalid package-lock\.json: packages field must be an object/ ); // Test unsupported lockfile version await assert.rejects( - convertPackageLockToShrinkwrap(v2Dir, "@ui5/cli"), + extractFromWorkspaceLockfile(v2Dir, "@ui5/cli"), /Unsupported lockfile version: 2\. Only lockfile version 3 is supported/ ); }); From a4e65897c4b35d3b358076d4409f09a46ce29c22 Mon Sep 17 00:00:00 2001 From: d3xter666 Date: Thu, 27 Aug 2026 18:29:58 +0300 Subject: [PATCH 02/11] feat(cli): Replace npm-shrinkwrap.json with bundleDependencies Migrates from the deprecated npm-shrinkwrap.json (npm/cli#9262) to bundleDependencies: true. The lockfile-extractor now generates a standalone package-lock.json; the package is then copied outside the workspace, installed via npm ci, and packed via npm pack to bundle all production node_modules. --- .github/workflows/github-ci.yml | 4 +- .github/workflows/release-please.yml | 32 +- .github/workflows/reuse-compliance.yml | 2 +- .gitignore | 5 +- AGENTS.md | 4 +- commitlint.config.mjs | 2 +- docs/Release-Workflow.md | 6 +- internal/lockfile-extractor/REUSE.toml | 4 +- package-lock.json | 722 ++++++++++++++++++++++--- packages/cli/package.json | 2 +- 10 files changed, 700 insertions(+), 83 deletions(-) diff --git a/.github/workflows/github-ci.yml b/.github/workflows/github-ci.yml index 4e3ee72fcc5..c89ad1a2c59 100644 --- a/.github/workflows/github-ci.yml +++ b/.github/workflows/github-ci.yml @@ -86,6 +86,6 @@ jobs: npm run build:vitepress npm run build:assets - - name: Check shrinkwrap integrity - working-directory: internal/shrinkwrap-extractor + - name: Check lockfile extractor integrity + working-directory: internal/lockfile-extractor run: npm run test diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 816a1895ad5..b246997ed0b 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -76,7 +76,7 @@ jobs: environment: npmjs:ui5-cli-mono strategy: # Sequential publishing ensures dependencies exist on NPM before dependents are published - # Order: logger → fs → builder → server → project (CLI handled separately for shrinkwrap generation) + # Order: logger → fs → builder → server → project (CLI handled separately for lockfile generation) max-parallel: 1 matrix: package: [logger, fs, builder, server, project] @@ -131,14 +131,34 @@ jobs: - name: Install dependencies run: npm ci - - name: Generate npm-shrinkwrap.json + - name: Generate package-lock.json for bundling working-directory: packages/cli run: | set -e - node ../../internal/shrinkwrap-extractor/cli.js ../../ + node ../../internal/lockfile-extractor/cli.js ../../ - - name: Publish @ui5/cli package - working-directory: packages/cli + - name: Bundle and publish @ui5/cli run: | - echo "🚀 Publishing @ui5/cli" + set -e + TEMP_CLI_DIR=$(mktemp -d) + + # Copy package (including generated package-lock.json) outside the workspace + cp -r packages/cli/. "$TEMP_CLI_DIR/" + echo "📦 Copied @ui5/cli to temporary directory: $TEMP_CLI_DIR" + + cd "$TEMP_CLI_DIR" + + # Strip devDependencies so npm ci only installs production deps matching the lock file + node -e " + const fs = require('fs'); + const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8')); + delete pkg.devDependencies; + fs.writeFileSync('package.json', JSON.stringify(pkg, null, '\t')); + " + + # Install exact versions from generated lock file (no workspace symlinks) + echo "📦 Installing production dependencies from package-lock.json" + npm ci + + echo "🚀 Publishing @ui5/cli from temporary directory: $TEMP_CLI_DIR" npm publish --access public --tag next diff --git a/.github/workflows/reuse-compliance.yml b/.github/workflows/reuse-compliance.yml index 47605fa21d8..9ce4113a3dd 100644 --- a/.github/workflows/reuse-compliance.yml +++ b/.github/workflows/reuse-compliance.yml @@ -19,7 +19,7 @@ jobs: matrix: package: - "internal/documentation" - - "internal/shrinkwrap-extractor" + - "internal/lockfile-extractor" - "packages/builder" - "packages/cli" - "packages/fs" diff --git a/.gitignore b/.gitignore index a458c538d1b..92459e130c6 100644 --- a/.gitignore +++ b/.gitignore @@ -72,4 +72,7 @@ internal/documentation/docs/api internal/documentation/tmp # E2E-tests -internal/e2e-tests/tmp \ No newline at end of file +internal/e2e-tests/tmp + +# Generated during bundled CLI publish flow (not committed) +packages/cli/package-lock.json diff --git a/AGENTS.md b/AGENTS.md index 1c30e5ed125..b2d57ee2563 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -63,7 +63,7 @@ npm run coverage --workspace=@ui5/server # Single package Internal packages: - `internal/documentation` — VitePress docs + JSDoc + JSON schema generation -- `internal/shrinkwrap-extractor` — npm shrinkwrap utilities +- `internal/lockfile-extractor` — generates a standalone package-lock.json for @ui5/cli from the monorepo workspace lock file ### Internal package dependencies @@ -93,6 +93,6 @@ Conventional commits enforced via commitlint + husky. Subject must be sentence-c **Types**: `build`, `ci`, `deps`, `docs`, `feat`, `fix`, `perf`, `refactor`, `release`, `revert`, `style`, `test` -**Scopes** are package names: `builder`, `cli`, `documentation`, `fs`, `logger`, `project`, `server`, `shrinkwrap-extractor`. Some types restrict which scopes are valid (e.g., `feat` and `fix` only allow public package scopes). +**Scopes** are package names: `builder`, `cli`, `documentation`, `fs`, `logger`, `project`, `server`, `lockfile-extractor`. Some types restrict which scopes are valid (e.g., `feat` and `fix` only allow public package scopes). Examples: `feat(builder): Add CSS source map support`, `fix(server): Correct middleware ordering` diff --git a/commitlint.config.mjs b/commitlint.config.mjs index e1cd5a89e7d..53d5376c129 100644 --- a/commitlint.config.mjs +++ b/commitlint.config.mjs @@ -10,7 +10,7 @@ const PUBLIC_PACKAGES = [ const INTERNAL_PACKAGES = [ "documentation", - "shrinkwrap-extractor" + "lockfile-extractor" ]; const ALLOWED_TYPE_SCOPE_COMBINATIONS = { diff --git a/docs/Release-Workflow.md b/docs/Release-Workflow.md index 0c9d8adbf70..291f6ee30bd 100644 --- a/docs/Release-Workflow.md +++ b/docs/Release-Workflow.md @@ -37,9 +37,9 @@ The workflow consists of three main jobs: ### 3. `publish-cli` Job - **Trigger**: All other packages have been published -- **Purpose**: Generates `npm-shrinkwrap.json` using `shrinkwrap-extractor` and publishes the CLI package -- **Why separate**: The shrinkwrap must contain published registry versions of workspace packages, not workspace links. This requires all dependencies to be available on npm registry first. -- **How it works**: The `shrinkwrap-extractor` reads the monorepo's `package-lock.json`, extracts production dependencies for `@ui5/cli`, converts workspace references to registry URLs, and generates a valid `npm-shrinkwrap.json` that will be included in the published CLI package. +- **Purpose**: Generates a standalone `package-lock.json` using `lockfile-extractor`, installs outside the workspace, packs with `bundleDependencies`, and publishes the CLI package +- **Why separate**: The lock file must reference published registry versions of workspace packages, not workspace symlinks. This requires all `@ui5/*` dependencies to be available on the npm registry first. +- **How it works**: The `lockfile-extractor` reads the monorepo's `package-lock.json`, extracts production dependencies for `@ui5/cli`, resolves workspace references to registry URLs, and generates a standalone `package-lock.json`. The package is then copied outside the workspace, `npm ci` installs exact versions, and `npm pack` bundles all `node_modules` into the tarball via `bundleDependencies: true`. ## Release Please Configuration diff --git a/internal/lockfile-extractor/REUSE.toml b/internal/lockfile-extractor/REUSE.toml index 75466b3c066..0e74629c28f 100644 --- a/internal/lockfile-extractor/REUSE.toml +++ b/internal/lockfile-extractor/REUSE.toml @@ -1,7 +1,7 @@ version = 1 -SPDX-PackageName = "ui5-shrinkwrap-extractor" +SPDX-PackageName = "ui5-lockfile-extractor" SPDX-PackageSupplier = "SAP OpenUI5 " -SPDX-PackageDownloadLocation = "https://github.com/UI5/cli/tree/main/packages/shrinkwrap-extractor" +SPDX-PackageDownloadLocation = "https://github.com/UI5/cli/tree/main/internal/lockfile-extractor" SPDX-PackageComment = "The code in this project may include calls to APIs (“API Calls”) of\n SAP or third-party products or services developed outside of this project\n (“External Products”).\n “APIs” means application programming interfaces, as well as their respective\n specifications and implementing code that allows software to communicate with\n other software.\n API Calls to External Products are not licensed under the open source license\n that governs this project. The use of such API Calls and related External\n Products are subject to applicable additional agreements with the relevant\n provider of the External Products. In no event shall the open source license\n that governs this project grant any rights in or to any External Products,or\n alter, expand or supersede any terms of the applicable additional agreements.\n If you have a valid license agreement with SAP for the use of a particular SAP\n External Product, then you may make use of any API Calls included in this\n project’s code for that SAP External Product, subject to the terms of such\n license agreement. If you do not have a valid license agreement for the use of\n a particular SAP External Product, then you may only make use of any API Calls\n in this project for that SAP External Product for your internal, non-productive\n and non-commercial test and evaluation of such API Calls. Nothing herein grants\n you any rights to use or access any SAP External Product, or provide any third\n parties the right to use of access any SAP External Product, through API Calls." [[annotations]] diff --git a/package-lock.json b/package-lock.json index b13e8688602..f0db9feecaf 100644 --- a/package-lock.json +++ b/package-lock.json @@ -93,16 +93,17 @@ "npm": ">= 8" } }, - "internal/shrinkwrap-extractor": { - "name": "@ui5/shrinkwrap-extractor", + "internal/lockfile-extractor": { + "name": "@ui5/lockfile-extractor", "version": "1.0.0", "license": "Apache-2.0", "bin": { - "shrinkwrap-extractor": "cli.js" + "lockfile-extractor": "cli.js" }, "devDependencies": { "@npmcli/arborist": "^10.0.2", "@npmcli/config": "^11.0.1", + "depcheck": "^1.4.7", "eslint": "^10.9.1", "pacote": "^22.0.0" }, @@ -111,7 +112,7 @@ "npm": ">= 8" } }, - "internal/shrinkwrap-extractor/node_modules/@npmcli/agent": { + "internal/lockfile-extractor/node_modules/@npmcli/agent": { "version": "5.0.2", "resolved": "https://registry.npmjs.org/@npmcli/agent/-/agent-5.0.2.tgz", "integrity": "sha512-EkzGmEsgbQ1rqWkRJe2P0oQHx/ylZozDUNPMXCklLuSFL3GY+QyEfBUjhjCsgGXzh4OGpnHvkboSQgczjP/jJg==", @@ -128,7 +129,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/@npmcli/arborist": { + "internal/lockfile-extractor/node_modules/@npmcli/arborist": { "version": "10.0.2", "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-10.0.2.tgz", "integrity": "sha512-+pkXINqcFRhiSK6EvhzqfiKD43Qsp6KKl8nVijPVjvJZuxl501UPd7uO48wcSAnWIub7prHuxL2fxrFIEg1FzA==", @@ -179,7 +180,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/@npmcli/fs": { + "internal/lockfile-extractor/node_modules/@npmcli/fs": { "version": "6.0.0", "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-6.0.0.tgz", "integrity": "sha512-AheOs4swKka/XLtht6xxJDPezlQ7K2IYQ9Y8lST4JLDjnralnWuMM9AE2CdVcgQJ5omrXhsRzM7F7aYmeZBvKQ==", @@ -192,7 +193,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/@npmcli/git": { + "internal/lockfile-extractor/node_modules/@npmcli/git": { "version": "8.0.0", "resolved": "https://registry.npmjs.org/@npmcli/git/-/git-8.0.0.tgz", "integrity": "sha512-5P1oo+TbxZNAiiMBtpzHA8QyEGh5D69LYLexNWJEDXLdxnAZvT/SLitGJBXxjtCE4ftAcFOS/Tu2185MeIjooQ==", @@ -212,7 +213,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/@npmcli/installed-package-contents": { + "internal/lockfile-extractor/node_modules/@npmcli/installed-package-contents": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/@npmcli/installed-package-contents/-/installed-package-contents-5.0.0.tgz", "integrity": "sha512-6Ay12sf2Lh7U1ifvnS1mq7TZFeh/rXHMXye+kV7jQrANIubaoVcleeh4HdFumxhsRYwm9OaHycB5lYmSwGrcIQ==", @@ -229,7 +230,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/@npmcli/map-workspaces": { + "internal/lockfile-extractor/node_modules/@npmcli/map-workspaces": { "version": "6.0.0", "resolved": "https://registry.npmjs.org/@npmcli/map-workspaces/-/map-workspaces-6.0.0.tgz", "integrity": "sha512-Dsex7XBea0BoFRbfALMbNuaNqeI3kbZJxiBMQhFvPUNluv0yEeKMd5FLIXy0NCsOuGMYQkLa+i219CadnoqLbg==", @@ -245,7 +246,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/@npmcli/metavuln-calculator": { + "internal/lockfile-extractor/node_modules/@npmcli/metavuln-calculator": { "version": "10.0.0", "resolved": "https://registry.npmjs.org/@npmcli/metavuln-calculator/-/metavuln-calculator-10.0.0.tgz", "integrity": "sha512-fC56lpGOae+unrFx6hoiWeWa0/4q+bLhOQTSrB65qcy+Zm34i1OdBcevAQFJJdUB/3i9uXw7PjdrrRjt0KSKXw==", @@ -262,7 +263,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/@npmcli/name-from-folder": { + "internal/lockfile-extractor/node_modules/@npmcli/name-from-folder": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/@npmcli/name-from-folder/-/name-from-folder-5.0.0.tgz", "integrity": "sha512-Mua2i5asmOn4sGGAsANS9Guamo7sgUd4BihhQWzlNGz6l/Ki23CzC2oGe4I94r2k/39ImCjDLbyu/rSJr/SXoA==", @@ -272,7 +273,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/@npmcli/node-gyp": { + "internal/lockfile-extractor/node_modules/@npmcli/node-gyp": { "version": "6.0.0", "resolved": "https://registry.npmjs.org/@npmcli/node-gyp/-/node-gyp-6.0.0.tgz", "integrity": "sha512-MFakpea4pcZNlHSTbMi15HK8RY8zl2UpgDtxhZCWOer+KRN3x7HFIMk/fKpOMgR55L4LIcA2qn8IHeyABhIFtw==", @@ -282,7 +283,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/@npmcli/package-json": { + "internal/lockfile-extractor/node_modules/@npmcli/package-json": { "version": "8.0.0", "resolved": "https://registry.npmjs.org/@npmcli/package-json/-/package-json-8.0.0.tgz", "integrity": "sha512-agNZzYQ18MR0wKp3Emg1q5QbcC8CXigYp3Z3CvB0Sax9Ge9aF4cVyyuSG+5SbACSrZUKTvMjVULWiE1RJA38wg==", @@ -301,7 +302,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/@npmcli/promise-spawn": { + "internal/lockfile-extractor/node_modules/@npmcli/promise-spawn": { "version": "10.0.0", "resolved": "https://registry.npmjs.org/@npmcli/promise-spawn/-/promise-spawn-10.0.0.tgz", "integrity": "sha512-llZkSzeTsimFx64U+ThT2xQM2uEce8GIQUYvxgbB6ZFvBhV2LP9LeJJb3HT+syG0uCFLsTCHjV9SfC0WNU1vtA==", @@ -314,7 +315,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/@npmcli/redact": { + "internal/lockfile-extractor/node_modules/@npmcli/redact": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/@npmcli/redact/-/redact-5.0.0.tgz", "integrity": "sha512-3zcN5Q3yEmeyxXBzqB6fXPQFzYa2ROsGFSr69W0ArXIAGJqxl/aFECOVPD2kbkYPm0U/EHxFKgclK3UA9WQg5A==", @@ -324,7 +325,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/@npmcli/run-script": { + "internal/lockfile-extractor/node_modules/@npmcli/run-script": { "version": "11.0.0", "resolved": "https://registry.npmjs.org/@npmcli/run-script/-/run-script-11.0.0.tgz", "integrity": "sha512-leBRl6F5F0TvWut8m1/aZcMTUHi2vXjKeMJ/Ik1lW7Q7Yy16Dhtkklu+cEqQww1p1NeLnUNzV3+uwpzqRcy9vw==", @@ -341,7 +342,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/@sigstore/bundle": { + "internal/lockfile-extractor/node_modules/@sigstore/bundle": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/@sigstore/bundle/-/bundle-5.0.0.tgz", "integrity": "sha512-wefjygudENbzbQMks1t5u34EP0fFoD0XvaEP7DOUP/sXKvogzEJYFw5E6pegGyp3onGWzVEYKVa3bNZWyTYX+A==", @@ -354,7 +355,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/@sigstore/core": { + "internal/lockfile-extractor/node_modules/@sigstore/core": { "version": "4.0.1", "resolved": "https://registry.npmjs.org/@sigstore/core/-/core-4.0.1.tgz", "integrity": "sha512-9v5hRjujn5NXq8o7XFEUgLyAtdr5Iisb4pzM05u3K61IS5q3hP3luWAndk0RkPPLTUFoTbg7Vb84UQ1ZQeajWQ==", @@ -364,7 +365,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/@sigstore/sign": { + "internal/lockfile-extractor/node_modules/@sigstore/sign": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/@sigstore/sign/-/sign-5.0.0.tgz", "integrity": "sha512-DSFivqz9/i5AkwZ5fq0YdjaJlc4o1WeS2Zffon0kqtChx0vy4W9NOjkEet9bF2vkzOufX72eVH8kZBIGtcBp1w==", @@ -382,7 +383,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/@sigstore/tuf": { + "internal/lockfile-extractor/node_modules/@sigstore/tuf": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/@sigstore/tuf/-/tuf-5.0.0.tgz", "integrity": "sha512-Zyqg9tcHps3uRAlKHLNmsW4ohsUZAjb9G+31r7lg0ICh/JOcadzmJsIRdjKljlRHpaR0K4aJ2kXXIdywdcdMlA==", @@ -396,7 +397,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/@sigstore/verify": { + "internal/lockfile-extractor/node_modules/@sigstore/verify": { "version": "4.1.2", "resolved": "https://registry.npmjs.org/@sigstore/verify/-/verify-4.1.2.tgz", "integrity": "sha512-BfD9eLrz3A/DG58aSgfgZYmIR6V9Yw96QVN/frtu2bEH7ctSTk2TDvHU12un3JsDPBTqTNkqkIkucjxljpOFqQ==", @@ -411,7 +412,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/@tufjs/models": { + "internal/lockfile-extractor/node_modules/@tufjs/models": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/@tufjs/models/-/models-5.0.0.tgz", "integrity": "sha512-U4mVcdFGOi6pt8n38LdWZp67Svn7ppnU1Pj8SGOVaBi1X4gm+G4ztQlLfkoJbKSHfjA6WeaiJp2A4V83AJF6nQ==", @@ -425,7 +426,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/abbrev": { + "internal/lockfile-extractor/node_modules/abbrev": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-5.0.0.tgz", "integrity": "sha512-/XrFJgzQQQHpti1raDJC6m4ws6aNktmjBlhk8Fdlk7LwCEuDoieEJJY9OFHjfiFJFFRM2tK+Ky/IsfbbmlMu1w==", @@ -435,7 +436,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/agent-base": { + "internal/lockfile-extractor/node_modules/agent-base": { "version": "9.0.0", "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-9.0.0.tgz", "integrity": "sha512-TQf59BsZnytt8GdJKLPfUZ54g/iaUL2OWDSFCCvMOhsHduDQxO8xC4PNeyIkVcA5KwL2phPSv0douC0fgWzmnA==", @@ -445,7 +446,7 @@ "node": ">= 20" } }, - "internal/shrinkwrap-extractor/node_modules/bin-links": { + "internal/lockfile-extractor/node_modules/bin-links": { "version": "7.0.0", "resolved": "https://registry.npmjs.org/bin-links/-/bin-links-7.0.0.tgz", "integrity": "sha512-kEk4UROE3064ebMhwmW1qx5BFSBWzmqMe0UwUzn5gsbDyXHmqMUSO8MW6sieYNiRJsindpdnjg4U0D9iXUkIxQ==", @@ -462,7 +463,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/cacache": { + "internal/lockfile-extractor/node_modules/cacache": { "version": "21.0.1", "resolved": "https://registry.npmjs.org/cacache/-/cacache-21.0.1.tgz", "integrity": "sha512-pTwz/uj3Jyp6WXdJ6fWhR+7LVxVs6RyroQSn7KJwHsSxXuyGSp0pcMVcwSwTpCFq1X2YG8QBe0W+vN+cr0SwzA==", @@ -484,7 +485,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/cmd-shim": { + "internal/lockfile-extractor/node_modules/cmd-shim": { "version": "9.0.2", "resolved": "https://registry.npmjs.org/cmd-shim/-/cmd-shim-9.0.2.tgz", "integrity": "sha512-xVHoI+wNrM4tDB9iC1idf/8D0tYnVimlBp/5zHW+x1sGjjRD69NvR9th3Z1JAYGN/BTW4he6aZFYV6kzy+k+jw==", @@ -494,7 +495,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/hosted-git-info": { + "internal/lockfile-extractor/node_modules/hosted-git-info": { "version": "10.1.1", "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-10.1.1.tgz", "integrity": "sha512-DeOnSPAvOndYKfw075gt8yZzQ7S2hNztw34zBTfhIzLhmBTswIBg5/y+pqu/VD5cYWm5goAFTusDmUEmKZ0PEQ==", @@ -507,7 +508,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/http-proxy-agent": { + "internal/lockfile-extractor/node_modules/http-proxy-agent": { "version": "9.1.0", "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-9.1.0.tgz", "integrity": "sha512-2NxoveTT58mjYT4n3RPTEfCZGLMbidoO8XEieXfpSYxu+PQJ1qpx4ypwH6N+uF9twBPIvRRgvkvW5HUTYWENig==", @@ -522,7 +523,7 @@ "node": ">= 20" } }, - "internal/shrinkwrap-extractor/node_modules/https-proxy-agent": { + "internal/lockfile-extractor/node_modules/https-proxy-agent": { "version": "9.1.0", "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-9.1.0.tgz", "integrity": "sha512-ag87y7cJJ9/3+GxFr8Oy4O5faDsGRGnBGsJj/YjOSsSx/5eadKLYTMPlzuR6obgoCDDm0abAAZitXXQkMOPSpA==", @@ -537,7 +538,7 @@ "node": ">= 20" } }, - "internal/shrinkwrap-extractor/node_modules/ignore-walk": { + "internal/lockfile-extractor/node_modules/ignore-walk": { "version": "9.0.0", "resolved": "https://registry.npmjs.org/ignore-walk/-/ignore-walk-9.0.0.tgz", "integrity": "sha512-tCBEZV2z2FNpIDl2vrhiWzIHzs4qOAuIDEO85eS02vZ3L1U3P56qpPL8GuGGAijDktAEaq2swMkO/Fmbo7YmfQ==", @@ -550,7 +551,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/ini": { + "internal/lockfile-extractor/node_modules/ini": { "version": "7.0.0", "resolved": "https://registry.npmjs.org/ini/-/ini-7.0.0.tgz", "integrity": "sha512-ifK0CgjALofS5bkrcTy4RaQ9Vx2Knf/eLeIO+NaswQEpH1UblrtTSCIvN71qQDMq0PeQ/SSPojvEJp9vvvfr+w==", @@ -560,7 +561,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/json-parse-even-better-errors": { + "internal/lockfile-extractor/node_modules/json-parse-even-better-errors": { "version": "6.0.0", "resolved": "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-6.0.0.tgz", "integrity": "sha512-2/8adwnK1/+Fdjyts4r6wSpfANWw8zdNhU9U/Llk59c6O+DjSisPWPykwoL8gZmocP9Dy64S7oie2g+Mia123A==", @@ -570,7 +571,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/lru-cache": { + "internal/lockfile-extractor/node_modules/lru-cache": { "version": "11.5.2", "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz", "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==", @@ -580,7 +581,7 @@ "node": "20 || >=22" } }, - "internal/shrinkwrap-extractor/node_modules/make-fetch-happen": { + "internal/lockfile-extractor/node_modules/make-fetch-happen": { "version": "16.0.1", "resolved": "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-16.0.1.tgz", "integrity": "sha512-uUv1yxHzaKVVEPfcFeGSNov/Cehjv08ovlY8ImTljgL7Q+SiA0dAYLQ6SYVa2kkKqNj4Y3aZEI7xv2teadie0A==", @@ -604,7 +605,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/minipass-fetch": { + "internal/lockfile-extractor/node_modules/minipass-fetch": { "version": "6.0.0", "resolved": "https://registry.npmjs.org/minipass-fetch/-/minipass-fetch-6.0.0.tgz", "integrity": "sha512-AWI8bKapGmgx/J0E6IGYSKj8TiHebZkmKWSs8raPSw8KXwgEAJ+Bw3+LSdXHR6T/RHKAWCOYk2MiLrYluaUU6w==", @@ -622,7 +623,7 @@ "iconv-lite": "^0.7.2" } }, - "internal/shrinkwrap-extractor/node_modules/node-gyp": { + "internal/lockfile-extractor/node_modules/node-gyp": { "version": "13.0.2", "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-13.0.2.tgz", "integrity": "sha512-SXTvw3PxznpowYhJSOD9mVQBgDaCTWXffX+wQZsQ7PbcTV86TsXCUcSZhHnskFQvrvn/OdSzJPMsptT2pIj9ww==", @@ -647,7 +648,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/nopt": { + "internal/lockfile-extractor/node_modules/nopt": { "version": "10.0.1", "resolved": "https://registry.npmjs.org/nopt/-/nopt-10.0.1.tgz", "integrity": "sha512-df3sBr/6ax9hSGuC3CspvLlbnX8cP5L5nZwXF8cGN8l0zSWR6BvzmQ6jPUKjvo6+/xdpkNvEcucBNUdBeeV13g==", @@ -663,7 +664,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/npm-bundled": { + "internal/lockfile-extractor/node_modules/npm-bundled": { "version": "6.0.0", "resolved": "https://registry.npmjs.org/npm-bundled/-/npm-bundled-6.0.0.tgz", "integrity": "sha512-EqdodKEW6pYM+dPxA66TZQfMEqVDiuzjDM9edSjuPI1mXUbUJwVxkgqMZSJvs8RTXz2CGq8HUol/AffTZX5g8w==", @@ -676,7 +677,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/npm-install-checks": { + "internal/lockfile-extractor/node_modules/npm-install-checks": { "version": "9.0.0", "resolved": "https://registry.npmjs.org/npm-install-checks/-/npm-install-checks-9.0.0.tgz", "integrity": "sha512-t05Izcgi7p15cpldqoiXYpjzlkTTvBw33sgjmL/JjcvtV0ydbm2O4iEXO8A6smqComu5FAQhUas86HTMQ6Z1Uw==", @@ -689,7 +690,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/npm-normalize-package-bin": { + "internal/lockfile-extractor/node_modules/npm-normalize-package-bin": { "version": "6.0.0", "resolved": "https://registry.npmjs.org/npm-normalize-package-bin/-/npm-normalize-package-bin-6.0.0.tgz", "integrity": "sha512-tdt4aFn9QamlhdN3HV2D2ccpBwO5/fyjjbXUxYA6uBjyekMZcZvDq0aSj9t5Jo+tih6AYFnt/cuIRn9013e0Uw==", @@ -699,7 +700,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/npm-package-arg": { + "internal/lockfile-extractor/node_modules/npm-package-arg": { "version": "14.0.0", "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-14.0.0.tgz", "integrity": "sha512-69XQh3k+dtGa1p+7RaR57IuG3rCko96xr/nUfN4yDYBXbTYICiWcOpsFKLN2GtGE9cyIljE+f1exnaYt9MvM+Q==", @@ -715,7 +716,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/npm-packlist": { + "internal/lockfile-extractor/node_modules/npm-packlist": { "version": "11.3.0", "resolved": "https://registry.npmjs.org/npm-packlist/-/npm-packlist-11.3.0.tgz", "integrity": "sha512-cS1yVkyriZgQAbiK8PtwhZHEtsFOsKHsCg5Ww2ONckAvXIspgqd6o4WirOzvkupU24iMRZ4xtO4kb2iK2rbnag==", @@ -730,7 +731,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/npm-pick-manifest": { + "internal/lockfile-extractor/node_modules/npm-pick-manifest": { "version": "12.0.0", "resolved": "https://registry.npmjs.org/npm-pick-manifest/-/npm-pick-manifest-12.0.0.tgz", "integrity": "sha512-8Fs3YLrnNOhrCdPNZy18MzNgVC58LTDAFzq1FdZO/p3BHeCC/coz+t4F5Pxabys8HJpyTUorMea26GkXsb4J/Q==", @@ -746,7 +747,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/npm-registry-fetch": { + "internal/lockfile-extractor/node_modules/npm-registry-fetch": { "version": "20.0.1", "resolved": "https://registry.npmjs.org/npm-registry-fetch/-/npm-registry-fetch-20.0.1.tgz", "integrity": "sha512-vzc1svxw/kw1IRjFsLi6gaxe1Olqm88V0tIfu2u5raL0b1gChe6ZEXNkyUlKxUC7s/egt5NxZHkbY18tMKKLfQ==", @@ -766,7 +767,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/pacote": { + "internal/lockfile-extractor/node_modules/pacote": { "version": "22.0.0", "resolved": "https://registry.npmjs.org/pacote/-/pacote-22.0.0.tgz", "integrity": "sha512-++VqeOZeL03uGM2MFLk96jGCSt1owBGkyFKoPr+trwNlZhCpjN2RrvwYxt8nTbs1wNMqSFYurq0TafVWkAIHig==", @@ -798,7 +799,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/parse-conflict-json": { + "internal/lockfile-extractor/node_modules/parse-conflict-json": { "version": "6.0.0", "resolved": "https://registry.npmjs.org/parse-conflict-json/-/parse-conflict-json-6.0.0.tgz", "integrity": "sha512-JIdsITvN0yVRpYxiip9DpCduYi75AryIDSCf6ez/Yul6PV46L0B/8SxSvLiMmWiUZKopLrD1BZgexxCfufoT9w==", @@ -813,7 +814,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/proc-log": { + "internal/lockfile-extractor/node_modules/proc-log": { "version": "7.0.0", "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-7.0.0.tgz", "integrity": "sha512-FYgfaA69XZ93zaXLoMNQ+ViDXGGBgR8aLh03txzcFhV+9xOXx7+8DLCULrKKpR9+GsH9ZfHm82aSUPpozX0Ztg==", @@ -823,7 +824,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/read-cmd-shim": { + "internal/lockfile-extractor/node_modules/read-cmd-shim": { "version": "7.0.0", "resolved": "https://registry.npmjs.org/read-cmd-shim/-/read-cmd-shim-7.0.0.tgz", "integrity": "sha512-GkU4W2VYxlMQqyn9JQQm8opl/UIXRzCS7iau12zNZm//CperjtK9CtpNhIh7hzU807BSdcmJIcRWeu0LIkTkYQ==", @@ -833,7 +834,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/sigstore": { + "internal/lockfile-extractor/node_modules/sigstore": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/sigstore/-/sigstore-5.0.0.tgz", "integrity": "sha512-hJqJfoG/e4qFQaauQL00c6J6FrHLBGKtkFvW3JbTSIEFOhLrSjdSM/gWd/yUOfYo/gsERehTXGC1VZWX+9X4Dg==", @@ -851,7 +852,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/socks-proxy-agent": { + "internal/lockfile-extractor/node_modules/socks-proxy-agent": { "version": "10.1.0", "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-10.1.0.tgz", "integrity": "sha512-WlMj/67cEJ6MDI1OcsnjuYKDNDoyPCCYZ249kuuXPiMDw9F8PXkVaQ7YWu3siTydfQ/4BEZcvGzu+aYvz7dDCQ==", @@ -866,7 +867,7 @@ "node": ">= 20" } }, - "internal/shrinkwrap-extractor/node_modules/ssri": { + "internal/lockfile-extractor/node_modules/ssri": { "version": "14.0.0", "resolved": "https://registry.npmjs.org/ssri/-/ssri-14.0.0.tgz", "integrity": "sha512-jQxKI0yx0ZnTKrqjKkLDV2DXkBQn3k49JVmVqDGcDwKDtGDbImD/GXsq04KD0VVzCQQ9wZJYal3RwR1GzWTSow==", @@ -879,7 +880,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/tuf-js": { + "internal/lockfile-extractor/node_modules/tuf-js": { "version": "6.0.0", "resolved": "https://registry.npmjs.org/tuf-js/-/tuf-js-6.0.0.tgz", "integrity": "sha512-zlJVOIO68hmgo1//X4ENEcTGfuOTAtDPi8PsTsG+FyxD85E/ww1ZnwBbWo/yCEExGpI+Kilg7Z3qCdHX2BoJTQ==", @@ -894,17 +895,17 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/undici": { - "version": "8.10.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-8.10.0.tgz", - "integrity": "sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==", + "internal/lockfile-extractor/node_modules/undici": { + "version": "8.10.1", + "resolved": "https://registry.npmjs.org/undici/-/undici-8.10.1.tgz", + "integrity": "sha512-YQ3WlbqjYMmNpdvDH64jAgLjxuAR9+649calDWhbshYaeQGO2bR4nI94ORJmwI3J9YhoKQnpyGOK+0zlWS5N5Q==", "dev": true, "license": "MIT", "engines": { "node": ">=22.19.0" } }, - "internal/shrinkwrap-extractor/node_modules/validate-npm-package-name": { + "internal/lockfile-extractor/node_modules/validate-npm-package-name": { "version": "8.0.0", "resolved": "https://registry.npmjs.org/validate-npm-package-name/-/validate-npm-package-name-8.0.0.tgz", "integrity": "sha512-SCv6OOV6Xj2/3cXy3dGmADluJTNcL3o7hZAglNPTe+WYuEuvxgJzxPrSDLZhF+CwyQOubqgecjMmTJGMVLWjYQ==", @@ -914,7 +915,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/which": { + "internal/lockfile-extractor/node_modules/which": { "version": "7.0.0", "resolved": "https://registry.npmjs.org/which/-/which-7.0.0.tgz", "integrity": "sha512-RancgH2dmbLdHl6LRhEqvklWMgl/Hdnun0Y90KhBOLkMefg8Qa7/Zel8Sm+8HEcP6DEjzsWzpkuBQEZok58isA==", @@ -930,7 +931,7 @@ "node": "^22.22.2 || ^24.15.0 || >=26.0.0" } }, - "internal/shrinkwrap-extractor/node_modules/write-file-atomic": { + "internal/lockfile-extractor/node_modules/write-file-atomic": { "version": "8.0.0", "resolved": "https://registry.npmjs.org/write-file-atomic/-/write-file-atomic-8.0.0.tgz", "integrity": "sha512-dYwyZredl67GyLLIHJnRM3h2PcOmN5SkcgC7eM5DPDEOEl6dLFqVrMg3F1Ea32usj4VSVZtd2H4MtKTNOf6nPg==", @@ -5725,6 +5726,13 @@ "integrity": "sha512-RGdgjQUZba5p6QEFAVx2OGb8rQDL/cPRG7GiedRzMcJ1tYnUANBncjbSB1NRGwbvjcPeikRABz2nshyPk1bhWg==", "license": "MIT" }, + "node_modules/@types/minimatch": { + "version": "3.0.5", + "resolved": "https://registry.npmjs.org/@types/minimatch/-/minimatch-3.0.5.tgz", + "integrity": "sha512-Klz949h02Gz2uZCMGwDUSDS1YBlTdDDgbWHi+81l29tQALUtvz4rAYi5uoVhE5Lagoq6DeqAUlbrHvW/mXDgdQ==", + "dev": true, + "license": "MIT" + }, "node_modules/@types/node": { "version": "26.1.1", "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.1.tgz", @@ -5750,6 +5758,13 @@ "integrity": "sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA==", "license": "MIT" }, + "node_modules/@types/parse-json": { + "version": "4.0.2", + "resolved": "https://registry.npmjs.org/@types/parse-json/-/parse-json-4.0.2.tgz", + "integrity": "sha512-dISoDXWWQwUquiKsyZ4Ng+HX2KsPL7LyHKHQwgGFEA3IaKac4Obd+h2a/a6waisAoepJlBcx9paWqjA8/HVjCw==", + "dev": true, + "license": "MIT" + }, "node_modules/@types/unist": { "version": "3.0.3", "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz", @@ -6162,6 +6177,10 @@ "resolved": "packages/fs", "link": true }, + "node_modules/@ui5/lockfile-extractor": { + "resolved": "internal/lockfile-extractor", + "link": true + }, "node_modules/@ui5/logger": { "resolved": "packages/logger", "link": true @@ -6174,10 +6193,6 @@ "resolved": "packages/server", "link": true }, - "node_modules/@ui5/shrinkwrap-extractor": { - "resolved": "internal/shrinkwrap-extractor", - "link": true - }, "node_modules/@ungap/structured-clone": { "version": "1.3.3", "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.3.tgz", @@ -6830,6 +6845,16 @@ "url": "https://github.com/sponsors/ljharb" } }, + "node_modules/array-differ": { + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/array-differ/-/array-differ-3.0.0.tgz", + "integrity": "sha512-THtfYS6KtME/yIAhKjZ2ul7XI96lQGHRputJQHO80LAWQnuGP4iCIN8vdMRboGbIEYBwU33q8Tch1os2+X0kMg==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=8" + } + }, "node_modules/array-find-index": { "version": "1.0.2", "resolved": "https://registry.npmjs.org/array-find-index/-/array-find-index-1.0.2.tgz", @@ -6847,6 +6872,16 @@ "dev": true, "license": "MIT" }, + "node_modules/array-union": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/array-union/-/array-union-2.1.0.tgz", + "integrity": "sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=8" + } + }, "node_modules/arraybuffer.prototype.slice": { "version": "1.0.4", "resolved": "https://registry.npmjs.org/arraybuffer.prototype.slice/-/arraybuffer.prototype.slice-1.0.4.tgz", @@ -7617,6 +7652,15 @@ "url": "https://github.com/sponsors/ljharb" } }, + "node_modules/callsite": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/callsite/-/callsite-1.0.0.tgz", + "integrity": "sha512-0vdNRFXn5q+dtOqjfFtmtlI9N2eVZ7LMyEV2iKC5mEEFvSg/69Ml6b/WU2qF8W1nLRa0wiSrDT3Y5jOHZCwKPQ==", + "dev": true, + "engines": { + "node": "*" + } + }, "node_modules/callsites": { "version": "4.2.0", "resolved": "https://registry.npmjs.org/callsites/-/callsites-4.2.0.tgz", @@ -9173,6 +9217,281 @@ "node": ">=0.4.0" } }, + "node_modules/depcheck": { + "version": "1.4.7", + "resolved": "https://registry.npmjs.org/depcheck/-/depcheck-1.4.7.tgz", + "integrity": "sha512-1lklS/bV5chOxwNKA/2XUUk/hPORp8zihZsXflr8x0kLwmcZ9Y9BsS6Hs3ssvA+2wUVbG0U2Ciqvm1SokNjPkA==", + "dev": true, + "license": "MIT", + "dependencies": { + "@babel/parser": "^7.23.0", + "@babel/traverse": "^7.23.2", + "@vue/compiler-sfc": "^3.3.4", + "callsite": "^1.0.0", + "camelcase": "^6.3.0", + "cosmiconfig": "^7.1.0", + "debug": "^4.3.4", + "deps-regex": "^0.2.0", + "findup-sync": "^5.0.0", + "ignore": "^5.2.4", + "is-core-module": "^2.12.0", + "js-yaml": "^3.14.1", + "json5": "^2.2.3", + "lodash": "^4.17.21", + "minimatch": "^7.4.6", + "multimatch": "^5.0.0", + "please-upgrade-node": "^3.2.0", + "readdirp": "^3.6.0", + "require-package-name": "^2.0.1", + "resolve": "^1.22.3", + "resolve-from": "^5.0.0", + "semver": "^7.5.4", + "yargs": "^16.2.0" + }, + "bin": { + "depcheck": "bin/depcheck.js" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/depcheck/node_modules/ansi-regex": { + "version": "5.0.1", + "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz", + "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/depcheck/node_modules/ansi-styles": { + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz", + "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==", + "dev": true, + "license": "MIT", + "dependencies": { + "color-convert": "^2.0.1" + }, + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/chalk/ansi-styles?sponsor=1" + } + }, + "node_modules/depcheck/node_modules/argparse": { + "version": "1.0.10", + "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz", + "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==", + "dev": true, + "license": "MIT", + "dependencies": { + "sprintf-js": "~1.0.2" + } + }, + "node_modules/depcheck/node_modules/balanced-match": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", + "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", + "dev": true, + "license": "MIT" + }, + "node_modules/depcheck/node_modules/brace-expansion": { + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0" + } + }, + "node_modules/depcheck/node_modules/camelcase": { + "version": "6.3.0", + "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz", + "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/depcheck/node_modules/cliui": { + "version": "7.0.4", + "resolved": "https://registry.npmjs.org/cliui/-/cliui-7.0.4.tgz", + "integrity": "sha512-OcRE68cOsVMXp1Yvonl/fzkQOyjLSu/8bhPDfQt0e0/Eb283TKP20Fs2MqoPsr9SwA595rRCA+QMzYc9nBP+JQ==", + "dev": true, + "license": "ISC", + "dependencies": { + "string-width": "^4.2.0", + "strip-ansi": "^6.0.0", + "wrap-ansi": "^7.0.0" + } + }, + "node_modules/depcheck/node_modules/cosmiconfig": { + "version": "7.1.0", + "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-7.1.0.tgz", + "integrity": "sha512-AdmX6xUzdNASswsFtmwSt7Vj8po9IuqXm0UXz7QKPuEUmPB4XyjGfaAr2PSuELMwkRMVH1EpIkX5bTZGRB3eCA==", + "dev": true, + "license": "MIT", + "dependencies": { + "@types/parse-json": "^4.0.0", + "import-fresh": "^3.2.1", + "parse-json": "^5.0.0", + "path-type": "^4.0.0", + "yaml": "^1.10.0" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/depcheck/node_modules/emoji-regex": { + "version": "8.0.0", + "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz", + "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==", + "dev": true, + "license": "MIT" + }, + "node_modules/depcheck/node_modules/is-fullwidth-code-point": { + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz", + "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/depcheck/node_modules/js-yaml": { + "version": "3.15.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz", + "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==", + "dev": true, + "license": "MIT", + "dependencies": { + "argparse": "^1.0.7", + "esprima": "^4.0.0" + }, + "bin": { + "js-yaml": "bin/js-yaml.js" + } + }, + "node_modules/depcheck/node_modules/minimatch": { + "version": "7.4.9", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-7.4.9.tgz", + "integrity": "sha512-Brg/fp/iAVDOQoHxkuN5bEYhyQlZhxddI78yWsCbeEwTHXQjlNLtiJDUsp1GIptVqMI7/gkJMz4vVAc01mpoBw==", + "dev": true, + "license": "ISC", + "dependencies": { + "brace-expansion": "^2.0.2" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, + "node_modules/depcheck/node_modules/path-type": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz", + "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/depcheck/node_modules/string-width": { + "version": "4.2.3", + "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz", + "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==", + "dev": true, + "license": "MIT", + "dependencies": { + "emoji-regex": "^8.0.0", + "is-fullwidth-code-point": "^3.0.0", + "strip-ansi": "^6.0.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/depcheck/node_modules/strip-ansi": { + "version": "6.0.1", + "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz", + "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==", + "dev": true, + "license": "MIT", + "dependencies": { + "ansi-regex": "^5.0.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/depcheck/node_modules/wrap-ansi": { + "version": "7.0.0", + "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz", + "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==", + "dev": true, + "license": "MIT", + "dependencies": { + "ansi-styles": "^4.0.0", + "string-width": "^4.1.0", + "strip-ansi": "^6.0.0" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/chalk/wrap-ansi?sponsor=1" + } + }, + "node_modules/depcheck/node_modules/yaml": { + "version": "1.10.3", + "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.3.tgz", + "integrity": "sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA==", + "dev": true, + "license": "ISC", + "engines": { + "node": ">= 6" + } + }, + "node_modules/depcheck/node_modules/yargs": { + "version": "16.2.2", + "resolved": "https://registry.npmjs.org/yargs/-/yargs-16.2.2.tgz", + "integrity": "sha512-Nt9ZJjXTv5R8MHbqby/wXQ6Gi0Bb3TcYZkR1bzuL4yB2OxWPkXknz513gEF0GoA6tn00UpbPvERW8rzCuWCA6w==", + "dev": true, + "license": "MIT", + "dependencies": { + "cliui": "^7.0.2", + "escalade": "^3.1.1", + "get-caller-file": "^2.0.5", + "require-directory": "^2.1.1", + "string-width": "^4.2.0", + "y18n": "^5.0.5", + "yargs-parser": "^20.2.2" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/depcheck/node_modules/yargs-parser": { + "version": "20.2.9", + "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-20.2.9.tgz", + "integrity": "sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==", + "dev": true, + "license": "ISC", + "engines": { + "node": ">=10" + } + }, "node_modules/depd": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz", @@ -9182,6 +9501,13 @@ "node": ">= 0.8" } }, + "node_modules/deps-regex": { + "version": "0.2.0", + "resolved": "https://registry.npmjs.org/deps-regex/-/deps-regex-0.2.0.tgz", + "integrity": "sha512-PwuBojGMQAYbWkMXOY9Pd/NWCDNHVH12pnS7WHqZkTSeMESe4hwnKKRp0yR87g37113x4JPbo/oIvXY+s/f56Q==", + "dev": true, + "license": "MIT" + }, "node_modules/dequal": { "version": "2.0.3", "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz", @@ -9192,6 +9518,16 @@ "node": ">=6" } }, + "node_modules/detect-file": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/detect-file/-/detect-file-1.0.0.tgz", + "integrity": "sha512-DtCOLG98P007x7wiiOmfI0fi3eIKyWiLTGJ2MDnVi/E04lWGbf+JzrRHMm0rgIIZJGtHpKpbVgLWHrv8xXpc3Q==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, "node_modules/detect-libc": { "version": "2.1.2", "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz", @@ -10332,6 +10668,19 @@ "url": "https://github.com/sindresorhus/execa?sponsor=1" } }, + "node_modules/expand-tilde": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/expand-tilde/-/expand-tilde-2.0.2.tgz", + "integrity": "sha512-A5EmesHW6rfnZ9ysHQjPdJRni0SRar0tjtG5MNtm9n5TUvsYU8oozprtRD4AqHxcZWWlVuAmQo2nWKfN9oyjTw==", + "dev": true, + "license": "MIT", + "dependencies": { + "homedir-polyfill": "^1.0.1" + }, + "engines": { + "node": ">=0.10.0" + } + }, "node_modules/exponential-backoff": { "version": "3.1.3", "resolved": "https://registry.npmjs.org/exponential-backoff/-/exponential-backoff-3.1.3.tgz", @@ -10666,6 +11015,22 @@ "url": "https://github.com/sponsors/sindresorhus" } }, + "node_modules/findup-sync": { + "version": "5.0.0", + "resolved": "https://registry.npmjs.org/findup-sync/-/findup-sync-5.0.0.tgz", + "integrity": "sha512-MzwXju70AuyflbgeOhzvQWAvvQdo1XL0A9bVvlXsYcFEBM87WR4OakL4OfZq+QRmr+duJubio+UtNQCPsVESzQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "detect-file": "^1.0.0", + "is-glob": "^4.0.3", + "micromatch": "^4.0.4", + "resolve-dir": "^1.0.1" + }, + "engines": { + "node": ">= 10.13.0" + } + }, "node_modules/flat-cache": { "version": "4.0.1", "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-4.0.1.tgz", @@ -11129,6 +11494,65 @@ "url": "https://github.com/sponsors/sindresorhus" } }, + "node_modules/global-modules": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/global-modules/-/global-modules-1.0.0.tgz", + "integrity": "sha512-sKzpEkf11GpOFuw0Zzjzmt4B4UZwjOcG757PPvrfhxcLFbq0wpsgpOqxpxtxFiCG4DtG93M6XRVbF2oGdev7bg==", + "dev": true, + "license": "MIT", + "dependencies": { + "global-prefix": "^1.0.1", + "is-windows": "^1.0.1", + "resolve-dir": "^1.0.0" + }, + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/global-prefix": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/global-prefix/-/global-prefix-1.0.2.tgz", + "integrity": "sha512-5lsx1NUDHtSjfg0eHlmYvZKv8/nVqX4ckFbM+FrGcQ+04KWcWFo9P5MxPZYSzUvyzmdTbI7Eix8Q4IbELDqzKg==", + "dev": true, + "license": "MIT", + "dependencies": { + "expand-tilde": "^2.0.2", + "homedir-polyfill": "^1.0.1", + "ini": "^1.3.4", + "is-windows": "^1.0.1", + "which": "^1.2.14" + }, + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/global-prefix/node_modules/ini": { + "version": "1.3.8", + "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz", + "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==", + "dev": true, + "license": "ISC" + }, + "node_modules/global-prefix/node_modules/isexe": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz", + "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==", + "dev": true, + "license": "ISC" + }, + "node_modules/global-prefix/node_modules/which": { + "version": "1.3.1", + "resolved": "https://registry.npmjs.org/which/-/which-1.3.1.tgz", + "integrity": "sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==", + "dev": true, + "license": "ISC", + "dependencies": { + "isexe": "^2.0.0" + }, + "bin": { + "which": "bin/which" + } + }, "node_modules/globals": { "version": "17.11.0", "resolved": "https://registry.npmjs.org/globals/-/globals-17.11.0.tgz", @@ -11388,6 +11812,19 @@ "url": "https://opencollective.com/unified" } }, + "node_modules/homedir-polyfill": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/homedir-polyfill/-/homedir-polyfill-1.0.3.tgz", + "integrity": "sha512-eSmmWE5bZTK2Nou4g0AI3zZ9rswp7GRKoKXS1BLUkvPviOqs4YTN1djQIqrXy9k5gEtdLPy86JjRwsNM9tnDcA==", + "dev": true, + "license": "MIT", + "dependencies": { + "parse-passwd": "^1.0.0" + }, + "engines": { + "node": ">=0.10.0" + } + }, "node_modules/hookable": { "version": "5.5.3", "resolved": "https://registry.npmjs.org/hookable/-/hookable-5.5.3.tgz", @@ -14247,6 +14684,67 @@ "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==", "license": "MIT" }, + "node_modules/multimatch": { + "version": "5.0.0", + "resolved": "https://registry.npmjs.org/multimatch/-/multimatch-5.0.0.tgz", + "integrity": "sha512-ypMKuglUrZUD99Tk2bUQ+xNQj43lPEfAeX2o9cTteAmShXy2VHDJpuwu1o0xqoKCt9jLVAvwyFKdLTPXKAfJyA==", + "dev": true, + "license": "MIT", + "dependencies": { + "@types/minimatch": "^3.0.3", + "array-differ": "^3.0.0", + "array-union": "^2.1.0", + "arrify": "^2.0.1", + "minimatch": "^3.0.4" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/multimatch/node_modules/arrify": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/arrify/-/arrify-2.0.1.tgz", + "integrity": "sha512-3duEwti880xqi4eAMN8AyR4a0ByT90zoYdLlevfrvU43vb0YZwZVfxOgxWrLXXXpyugL0hNZc9G6BiB5B3nUug==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=8" + } + }, + "node_modules/multimatch/node_modules/balanced-match": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", + "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", + "dev": true, + "license": "MIT" + }, + "node_modules/multimatch/node_modules/brace-expansion": { + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0", + "concat-map": "0.0.1" + } + }, + "node_modules/multimatch/node_modules/minimatch": { + "version": "3.1.5", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz", + "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==", + "dev": true, + "license": "ISC", + "dependencies": { + "brace-expansion": "^1.1.7" + }, + "engines": { + "node": "*" + } + }, "node_modules/nanoid": { "version": "3.3.18", "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", @@ -15286,6 +15784,16 @@ "url": "https://github.com/sponsors/sindresorhus" } }, + "node_modules/parse-passwd": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/parse-passwd/-/parse-passwd-1.0.0.tgz", + "integrity": "sha512-1Y1A//QUXEZK7YKz+rD9WydcE1+EuPr6ZBgKecAB8tmoW6UFv0NREVJe1p+jRxtThkcbbKkfwIbWJe/IeE6m2Q==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, "node_modules/parse-statements": { "version": "1.0.11", "resolved": "https://registry.npmjs.org/parse-statements/-/parse-statements-1.0.11.tgz", @@ -15472,6 +15980,16 @@ "node": ">=8" } }, + "node_modules/please-upgrade-node": { + "version": "3.2.0", + "resolved": "https://registry.npmjs.org/please-upgrade-node/-/please-upgrade-node-3.2.0.tgz", + "integrity": "sha512-gQR3WpIgNIKwBMVLkpMUeR3e1/E1y42bqDQZfql+kDeXd8COYfM8PQA4X6y7a8u9Ua9FHmsrrmirW2vHs45hWg==", + "dev": true, + "license": "MIT", + "dependencies": { + "semver-compare": "^1.0.0" + } + }, "node_modules/plur": { "version": "6.0.0", "resolved": "https://registry.npmjs.org/plur/-/plur-6.0.0.tgz", @@ -16463,6 +16981,32 @@ "node": ">= 6" } }, + "node_modules/readdirp": { + "version": "3.6.0", + "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz", + "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==", + "dev": true, + "license": "MIT", + "dependencies": { + "picomatch": "^2.2.1" + }, + "engines": { + "node": ">=8.10.0" + } + }, + "node_modules/readdirp/node_modules/picomatch": { + "version": "2.3.2", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz", + "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=8.6" + }, + "funding": { + "url": "https://github.com/sponsors/jonschlinkert" + } + }, "node_modules/readline-transform": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/readline-transform/-/readline-transform-1.0.0.tgz", @@ -16610,6 +17154,13 @@ "dev": true, "license": "ISC" }, + "node_modules/require-package-name": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/require-package-name/-/require-package-name-2.0.1.tgz", + "integrity": "sha512-uuoJ1hU/k6M0779t3VMVIYpb2VMJk05cehCaABFhXaibcbvfgR8wKiozLjVFSzJPmQMRqIcO0HMyTFqfV09V6Q==", + "dev": true, + "license": "MIT" + }, "node_modules/requizzle": { "version": "0.2.4", "resolved": "https://registry.npmjs.org/requizzle/-/requizzle-0.2.4.tgz", @@ -16665,6 +17216,20 @@ "node": ">=8" } }, + "node_modules/resolve-dir": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/resolve-dir/-/resolve-dir-1.0.1.tgz", + "integrity": "sha512-R7uiTjECzvOsWSfdM0QKFNBVFcK27aHOUwdvK53BcW8zqnGdYp0Fbj82cy54+2A4P2tFM22J5kRfe1R+lM/1yg==", + "dev": true, + "license": "MIT", + "dependencies": { + "expand-tilde": "^2.0.0", + "global-modules": "^1.0.0" + }, + "engines": { + "node": ">=0.10.0" + } + }, "node_modules/resolve-from": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz", @@ -16953,6 +17518,13 @@ "node": ">=10" } }, + "node_modules/semver-compare": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/semver-compare/-/semver-compare-1.0.0.tgz", + "integrity": "sha512-YM3/ITh2MJ5MtzaM429anh+x2jiLVjqILF4m4oyQB18W7Ggea7BfqdH/wGMK7dDiMghv/6WG7znWMwUDzJiXow==", + "dev": true, + "license": "MIT" + }, "node_modules/send": { "version": "1.2.1", "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz", @@ -19804,6 +20376,23 @@ "packages/cli": { "name": "@ui5/cli", "version": "5.0.0-alpha.9", + "bundleDependencies": [ + "@ui5/builder", + "@ui5/fs", + "@ui5/logger", + "@ui5/project", + "@ui5/server", + "chalk", + "data-with-position", + "import-local", + "js-yaml", + "open", + "pretty-hrtime", + "semver", + "update-notifier", + "yargs", + "yesno" + ], "license": "Apache-2.0", "dependencies": { "@ui5/builder": "^5.0.0-alpha.9", @@ -19847,6 +20436,7 @@ "version": "6.0.0", "resolved": "https://registry.npmjs.org/chalk/-/chalk-6.0.0.tgz", "integrity": "sha512-2uNTXIuTTxk7ciZgAU1BQcgnchcG0xXnrs6jzkQfj9SsRa9M2s5zE8WT96hS6KmG4MzWHSrvH43DF1m4XRkrFg==", + "inBundle": true, "license": "MIT", "engines": { "node": ">=22" @@ -19859,6 +20449,7 @@ "version": "9.0.1", "resolved": "https://registry.npmjs.org/cliui/-/cliui-9.0.1.tgz", "integrity": "sha512-k7ndgKhwoQveBL+/1tqGJYNz097I7WOvwbmmU2AR5+magtbjPWQTS1C5vzGkBC8Ym8UWRzfKUzUUqFLypY4Q+w==", + "inBundle": true, "license": "ISC", "dependencies": { "string-width": "^7.2.0", @@ -19873,6 +20464,7 @@ "version": "18.1.0", "resolved": "https://registry.npmjs.org/yargs/-/yargs-18.1.0.tgz", "integrity": "sha512-2rAgRKu54VsHkqI0/tYkmluGXHD4KW7yZoycuqDQ15QOTnc2VVfy0nN/1eMhnQLO00A+dwtK20xuCnc1YGeUyg==", + "inBundle": true, "license": "MIT", "dependencies": { "cliui": "^9.0.1", @@ -19890,6 +20482,7 @@ "version": "22.0.0", "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-22.0.0.tgz", "integrity": "sha512-rwu/ClNdSMpkSrUb+d6BRsSkLUq1fmfsY6TOpYzTwvwkg1/NRG85KBy3kq++A8LKQwX6lsu+aWad+2khvuXrqw==", + "inBundle": true, "license": "ISC", "engines": { "node": "^20.19.0 || ^22.12.0 || >=23" @@ -19899,6 +20492,7 @@ "version": "8.2.2", "resolved": "https://registry.npmjs.org/string-width/-/string-width-8.2.2.tgz", "integrity": "sha512-GaPUh5gfdrYzqeVNZvUfT23vYYxXzKYidUcnMtJg/3rxRV63EFZy3k6xfKlmfeJD0176lnUV/Usr3XcwSvFzpg==", + "inBundle": true, "license": "MIT", "dependencies": { "get-east-asian-width": "^1.5.0", diff --git a/packages/cli/package.json b/packages/cli/package.json index 85bc4a965c2..e52b8bc8d32 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -40,11 +40,11 @@ }, "files": [ "CHANGELOG.md", - "npm-shrinkwrap.json", "bin/**", "lib/**", "LICENSES/**" ], + "bundleDependencies": true, "repository": { "type": "git", "url": "git+ssh://git@github.com/UI5/cli.git", From e594e6580aac177d099731424d4675fa26085c9b Mon Sep 17 00:00:00 2001 From: d3xter666 Date: Thu, 3 Sep 2026 14:47:32 +0300 Subject: [PATCH 03/11] test: Emulate release in regular CI checks --- .github/workflows/bundle-and-publish-cli.yml | 85 ++++++++++++++++++++ .github/workflows/github-ci.yml | 9 +++ .github/workflows/release-please.yml | 52 ++---------- 3 files changed, 100 insertions(+), 46 deletions(-) create mode 100644 .github/workflows/bundle-and-publish-cli.yml diff --git a/.github/workflows/bundle-and-publish-cli.yml b/.github/workflows/bundle-and-publish-cli.yml new file mode 100644 index 00000000000..62143dba3cf --- /dev/null +++ b/.github/workflows/bundle-and-publish-cli.yml @@ -0,0 +1,85 @@ +name: Bundle and Publish @ui5/cli + +# Reusable workflow: called by release-please.yml (real publish) and github-ci.yml (dry-run). +# The caller controls whether the publish is real or dry-run via the dry_run input. + +on: + workflow_call: + inputs: + dry_run: + description: "Skip actual publish — runs npm publish --dry-run for CI verification" + type: boolean + default: false + npm_tag: + description: "npm dist-tag (e.g. next, latest)" + type: string + default: next + npm_env: + # Setting this shapes the OIDC token subject claim to + # 'repo:UI5/cli:environment:', which must match the trusted + # publisher configuration on npmjs.com. + # Pass 'npmjs:ui5-cli-mono' for a real publish; leave empty for + # dry-run calls (npm publish --dry-run never contacts the registry, + # so no OIDC token is needed — and omitting the environment avoids + # deployment-protection rules that would otherwise block PR builds). + description: > + GitHub Actions environment name for OIDC trusted publishing (e.g. npmjs:ui5-cli-mono). Leave empty for dry-run calls." + type: string + default: "" + +jobs: + bundle-and-publish: + runs-on: ubuntu-24.04 + # Controls the OIDC subject claim: 'repo:UI5/cli:environment:'. + # npm's trusted publisher verifies this claim — empty string means no environment + # (subject becomes 'repo:UI5/cli:ref:refs/heads/...'), used for dry-run only. + environment: ${{ inputs.npm_env }} + permissions: + id-token: write # Required for OIDC trusted publishing; harmless when npm_env is empty + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Node.js LTS + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: 24.x + + - name: Install dependencies + run: npm ci + + - name: Generate package-lock.json for bundling + working-directory: packages/cli + run: | + set -e + node ../../internal/lockfile-extractor/cli.js ../../ + + - name: Bundle and publish @ui5/cli + run: | + set -e + TEMP_CLI_DIR=$(mktemp -d) + + # Copy package (including generated package-lock.json) outside the workspace + cp -r packages/cli/. "$TEMP_CLI_DIR/" + echo "📦 Copied @ui5/cli to temporary directory: $TEMP_CLI_DIR" + + cd "$TEMP_CLI_DIR" + + # Strip devDependencies so npm ci only installs production deps matching the lock file + node -e " + const fs = require('fs'); + const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8')); + delete pkg.devDependencies; + fs.writeFileSync('package.json', JSON.stringify(pkg, null, '\t')); + " + + # Install exact versions from generated lock file (no workspace symlinks) + echo "📦 Installing production dependencies from package-lock.json" + npm ci + + if [ "${{ inputs.dry_run }}" = "true" ]; then + echo "🔍 Dry-run: reporting what would be published (no actual publish)" + npm publish --access public --tag "${{ inputs.npm_tag }}" --dry-run + else + echo "🚀 Publishing @ui5/cli from temporary directory: $TEMP_CLI_DIR" + npm publish --access public --tag "${{ inputs.npm_tag }}" + fi diff --git a/.github/workflows/github-ci.yml b/.github/workflows/github-ci.yml index c89ad1a2c59..fa717c49f2b 100644 --- a/.github/workflows/github-ci.yml +++ b/.github/workflows/github-ci.yml @@ -89,3 +89,12 @@ jobs: - name: Check lockfile extractor integrity working-directory: internal/lockfile-extractor run: npm run test + + bundle-cli-dry-run: + name: Verify @ui5/cli bundle (dry-run) + needs: test + permissions: + id-token: write # Required by the reusable workflow's job declaration; token is requested but unused in dry-run + uses: ./.github/workflows/bundle-and-publish-cli.yml + with: + dry_run: true diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index b246997ed0b..3cf8582b8a1 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -98,7 +98,6 @@ jobs: npm publish --access public --tag next publish-cli: - runs-on: ubuntu-24.04 needs: [release-please, publish-packages] # Two paths: # 1. Automatic: release-please created releases and publish-packages succeeded @@ -117,48 +116,9 @@ jobs: ) ) permissions: - id-token: write # Required for trusted publishing via OIDC (https://docs.npmjs.com/trusted-publishers) - # The GitHub Actions Environment configured for the trusted publisher - environment: npmjs:ui5-cli-mono - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - - name: Node.js LTS - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 - with: - node-version: 24.x - - - name: Install dependencies - run: npm ci - - - name: Generate package-lock.json for bundling - working-directory: packages/cli - run: | - set -e - node ../../internal/lockfile-extractor/cli.js ../../ - - - name: Bundle and publish @ui5/cli - run: | - set -e - TEMP_CLI_DIR=$(mktemp -d) - - # Copy package (including generated package-lock.json) outside the workspace - cp -r packages/cli/. "$TEMP_CLI_DIR/" - echo "📦 Copied @ui5/cli to temporary directory: $TEMP_CLI_DIR" - - cd "$TEMP_CLI_DIR" - - # Strip devDependencies so npm ci only installs production deps matching the lock file - node -e " - const fs = require('fs'); - const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8')); - delete pkg.devDependencies; - fs.writeFileSync('package.json', JSON.stringify(pkg, null, '\t')); - " - - # Install exact versions from generated lock file (no workspace symlinks) - echo "📦 Installing production dependencies from package-lock.json" - npm ci - - echo "🚀 Publishing @ui5/cli from temporary directory: $TEMP_CLI_DIR" - npm publish --access public --tag next + id-token: write # Required for OIDC trusted publishing inside the reusable workflow + uses: ./.github/workflows/bundle-and-publish-cli.yml + with: + dry_run: false + npm_tag: next + npm_env: npmjs:ui5-cli-mono From 9035aa343f3bd28a006526f23ad7ac386324475d Mon Sep 17 00:00:00 2001 From: Yavor Ivanov Date: Fri, 4 Sep 2026 11:10:12 +0300 Subject: [PATCH 04/11] docs: Update .github/workflows/github-ci.yml Co-authored-by: Merlin Beutlberger --- .github/workflows/github-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/github-ci.yml b/.github/workflows/github-ci.yml index fa717c49f2b..67955a3211c 100644 --- a/.github/workflows/github-ci.yml +++ b/.github/workflows/github-ci.yml @@ -86,7 +86,7 @@ jobs: npm run build:vitepress npm run build:assets - - name: Check lockfile extractor integrity + - name: Run lockfile extractor tests working-directory: internal/lockfile-extractor run: npm run test From eae3e2760ebeb2db2a0afd85f82405cbab87f678 Mon Sep 17 00:00:00 2001 From: Yavor Ivanov Date: Fri, 4 Sep 2026 11:10:41 +0300 Subject: [PATCH 05/11] fix: Update .github/workflows/bundle-and-publish-cli.yml Co-authored-by: Merlin Beutlberger --- .github/workflows/bundle-and-publish-cli.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/bundle-and-publish-cli.yml b/.github/workflows/bundle-and-publish-cli.yml index 62143dba3cf..a0f356adeea 100644 --- a/.github/workflows/bundle-and-publish-cli.yml +++ b/.github/workflows/bundle-and-publish-cli.yml @@ -38,6 +38,8 @@ jobs: id-token: write # Required for OIDC trusted publishing; harmless when npm_env is empty steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Node.js LTS uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 From 92446543a59cb10962c33ecccb2a3184980f1d78 Mon Sep 17 00:00:00 2001 From: d3xter666 Date: Fri, 4 Sep 2026 11:37:20 +0300 Subject: [PATCH 06/11] fix: Correct zizmor findings for GH Actions --- .github/workflows/bundle-and-publish-cli.yml | 9 ++++++--- .github/workflows/github-ci.yml | 2 +- .github/workflows/release-please.yml | 2 +- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/.github/workflows/bundle-and-publish-cli.yml b/.github/workflows/bundle-and-publish-cli.yml index a0f356adeea..bca4eeee30a 100644 --- a/.github/workflows/bundle-and-publish-cli.yml +++ b/.github/workflows/bundle-and-publish-cli.yml @@ -56,6 +56,9 @@ jobs: node ../../internal/lockfile-extractor/cli.js ../../ - name: Bundle and publish @ui5/cli + env: + NPM_TAG: ${{ inputs.npm_tag }} + DRY_RUN: ${{ inputs.dry_run }} run: | set -e TEMP_CLI_DIR=$(mktemp -d) @@ -78,10 +81,10 @@ jobs: echo "📦 Installing production dependencies from package-lock.json" npm ci - if [ "${{ inputs.dry_run }}" = "true" ]; then + if [ "$DRY_RUN" = "true" ]; then echo "🔍 Dry-run: reporting what would be published (no actual publish)" - npm publish --access public --tag "${{ inputs.npm_tag }}" --dry-run + npm publish --access public --tag "$NPM_TAG" --dry-run else echo "🚀 Publishing @ui5/cli from temporary directory: $TEMP_CLI_DIR" - npm publish --access public --tag "${{ inputs.npm_tag }}" + npm publish --access public --tag "$NPM_TAG" fi diff --git a/.github/workflows/github-ci.yml b/.github/workflows/github-ci.yml index 67955a3211c..c88677dffc1 100644 --- a/.github/workflows/github-ci.yml +++ b/.github/workflows/github-ci.yml @@ -95,6 +95,6 @@ jobs: needs: test permissions: id-token: write # Required by the reusable workflow's job declaration; token is requested but unused in dry-run - uses: ./.github/workflows/bundle-and-publish-cli.yml + uses: $/.github/workflows/bundle-and-publish-cli.yml with: dry_run: true diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 3cf8582b8a1..bac05a35106 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -117,7 +117,7 @@ jobs: ) permissions: id-token: write # Required for OIDC trusted publishing inside the reusable workflow - uses: ./.github/workflows/bundle-and-publish-cli.yml + uses: $/.github/workflows/bundle-and-publish-cli.yml with: dry_run: false npm_tag: next From 35d975c207c62777f9da9830f206de98571bd7b1 Mon Sep 17 00:00:00 2001 From: d3xter666 Date: Fri, 4 Sep 2026 11:56:37 +0300 Subject: [PATCH 07/11] fix: Limit permissions for only needed flows --- .github/workflows/bundle-and-publish-cli.yml | 7 ++++--- .github/workflows/github-ci.yml | 4 +--- .github/workflows/release-please.yml | 2 +- 3 files changed, 6 insertions(+), 7 deletions(-) diff --git a/.github/workflows/bundle-and-publish-cli.yml b/.github/workflows/bundle-and-publish-cli.yml index bca4eeee30a..3c795d57a19 100644 --- a/.github/workflows/bundle-and-publish-cli.yml +++ b/.github/workflows/bundle-and-publish-cli.yml @@ -23,7 +23,7 @@ on: # so no OIDC token is needed — and omitting the environment avoids # deployment-protection rules that would otherwise block PR builds). description: > - GitHub Actions environment name for OIDC trusted publishing (e.g. npmjs:ui5-cli-mono). Leave empty for dry-run calls." + GitHub Actions environment name for OIDC trusted publishing (e.g. npmjs:ui5-cli-mono). Leave empty for dry-run calls. type: string default: "" @@ -33,9 +33,10 @@ jobs: # Controls the OIDC subject claim: 'repo:UI5/cli:environment:'. # npm's trusted publisher verifies this claim — empty string means no environment # (subject becomes 'repo:UI5/cli:ref:refs/heads/...'), used for dry-run only. + # Permissions are not set here: they are inherited from the calling job. + # The real-publish caller (release-please.yml) passes id-token:write; + # the dry-run caller (github-ci.yml) does not, so no OIDC token is minted for dry-runs. environment: ${{ inputs.npm_env }} - permissions: - id-token: write # Required for OIDC trusted publishing; harmless when npm_env is empty steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/.github/workflows/github-ci.yml b/.github/workflows/github-ci.yml index c88677dffc1..ac386d39139 100644 --- a/.github/workflows/github-ci.yml +++ b/.github/workflows/github-ci.yml @@ -93,8 +93,6 @@ jobs: bundle-cli-dry-run: name: Verify @ui5/cli bundle (dry-run) needs: test - permissions: - id-token: write # Required by the reusable workflow's job declaration; token is requested but unused in dry-run - uses: $/.github/workflows/bundle-and-publish-cli.yml + uses: ./.github/workflows/bundle-and-publish-cli.yml with: dry_run: true diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index bac05a35106..3cf8582b8a1 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -117,7 +117,7 @@ jobs: ) permissions: id-token: write # Required for OIDC trusted publishing inside the reusable workflow - uses: $/.github/workflows/bundle-and-publish-cli.yml + uses: ./.github/workflows/bundle-and-publish-cli.yml with: dry_run: false npm_tag: next From a0689b8acb9251253a4d38ec4836bef837e5ced1 Mon Sep 17 00:00:00 2001 From: d3xter666 Date: Fri, 4 Sep 2026 16:54:46 +0300 Subject: [PATCH 08/11] refactor: Remove obsolete license This license file has been left here by accident. We now manage those licenses centrally --- .../LICENSES/Apache-2.0.txt | 208 ------------------ 1 file changed, 208 deletions(-) delete mode 100644 internal/lockfile-extractor/LICENSES/Apache-2.0.txt diff --git a/internal/lockfile-extractor/LICENSES/Apache-2.0.txt b/internal/lockfile-extractor/LICENSES/Apache-2.0.txt deleted file mode 100644 index 4ed90b95224..00000000000 --- a/internal/lockfile-extractor/LICENSES/Apache-2.0.txt +++ /dev/null @@ -1,208 +0,0 @@ -Apache License - -Version 2.0, January 2004 - -http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, -AND DISTRIBUTION - - 1. Definitions. - - - -"License" shall mean the terms and conditions for use, reproduction, and distribution -as defined by Sections 1 through 9 of this document. - - - -"Licensor" shall mean the copyright owner or entity authorized by the copyright -owner that is granting the License. - - - -"Legal Entity" shall mean the union of the acting entity and all other entities -that control, are controlled by, or are under common control with that entity. -For the purposes of this definition, "control" means (i) the power, direct -or indirect, to cause the direction or management of such entity, whether -by contract or otherwise, or (ii) ownership of fifty percent (50%) or more -of the outstanding shares, or (iii) beneficial ownership of such entity. - - - -"You" (or "Your") shall mean an individual or Legal Entity exercising permissions -granted by this License. - - - -"Source" form shall mean the preferred form for making modifications, including -but not limited to software source code, documentation source, and configuration -files. - - - -"Object" form shall mean any form resulting from mechanical transformation -or translation of a Source form, including but not limited to compiled object -code, generated documentation, and conversions to other media types. - - - -"Work" shall mean the work of authorship, whether in Source or Object form, -made available under the License, as indicated by a copyright notice that -is included in or attached to the work (an example is provided in the Appendix -below). - - - -"Derivative Works" shall mean any work, whether in Source or Object form, -that is based on (or derived from) the Work and for which the editorial revisions, -annotations, elaborations, or other modifications represent, as a whole, an -original work of authorship. For the purposes of this License, Derivative -Works shall not include works that remain separable from, or merely link (or -bind by name) to the interfaces of, the Work and Derivative Works thereof. - - - -"Contribution" shall mean any work of authorship, including the original version -of the Work and any modifications or additions to that Work or Derivative -Works thereof, that is intentionally submitted to Licensor for inclusion in -the Work by the copyright owner or by an individual or Legal Entity authorized -to submit on behalf of the copyright owner. For the purposes of this definition, -"submitted" means any form of electronic, verbal, or written communication -sent to the Licensor or its representatives, including but not limited to -communication on electronic mailing lists, source code control systems, and -issue tracking systems that are managed by, or on behalf of, the Licensor -for the purpose of discussing and improving the Work, but excluding communication -that is conspicuously marked or otherwise designated in writing by the copyright -owner as "Not a Contribution." - - - -"Contributor" shall mean Licensor and any individual or Legal Entity on behalf -of whom a Contribution has been received by Licensor and subsequently incorporated -within the Work. - -2. Grant of Copyright License. Subject to the terms and conditions of this -License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, -no-charge, royalty-free, irrevocable copyright license to reproduce, prepare -Derivative Works of, publicly display, publicly perform, sublicense, and distribute -the Work and such Derivative Works in Source or Object form. - -3. Grant of Patent License. Subject to the terms and conditions of this License, -each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, -no-charge, royalty-free, irrevocable (except as stated in this section) patent -license to make, have made, use, offer to sell, sell, import, and otherwise -transfer the Work, where such license applies only to those patent claims -licensable by such Contributor that are necessarily infringed by their Contribution(s) -alone or by combination of their Contribution(s) with the Work to which such -Contribution(s) was submitted. If You institute patent litigation against -any entity (including a cross-claim or counterclaim in a lawsuit) alleging -that the Work or a Contribution incorporated within the Work constitutes direct -or contributory patent infringement, then any patent licenses granted to You -under this License for that Work shall terminate as of the date such litigation -is filed. - -4. Redistribution. You may reproduce and distribute copies of the Work or -Derivative Works thereof in any medium, with or without modifications, and -in Source or Object form, provided that You meet the following conditions: - -(a) You must give any other recipients of the Work or Derivative Works a copy -of this License; and - -(b) You must cause any modified files to carry prominent notices stating that -You changed the files; and - -(c) You must retain, in the Source form of any Derivative Works that You distribute, -all copyright, patent, trademark, and attribution notices from the Source -form of the Work, excluding those notices that do not pertain to any part -of the Derivative Works; and - -(d) If the Work includes a "NOTICE" text file as part of its distribution, -then any Derivative Works that You distribute must include a readable copy -of the attribution notices contained within such NOTICE file, excluding those -notices that do not pertain to any part of the Derivative Works, in at least -one of the following places: within a NOTICE text file distributed as part -of the Derivative Works; within the Source form or documentation, if provided -along with the Derivative Works; or, within a display generated by the Derivative -Works, if and wherever such third-party notices normally appear. The contents -of the NOTICE file are for informational purposes only and do not modify the -License. You may add Your own attribution notices within Derivative Works -that You distribute, alongside or as an addendum to the NOTICE text from the -Work, provided that such additional attribution notices cannot be construed -as modifying the License. - -You may add Your own copyright statement to Your modifications and may provide -additional or different license terms and conditions for use, reproduction, -or distribution of Your modifications, or for any such Derivative Works as -a whole, provided Your use, reproduction, and distribution of the Work otherwise -complies with the conditions stated in this License. - -5. Submission of Contributions. Unless You explicitly state otherwise, any -Contribution intentionally submitted for inclusion in the Work by You to the -Licensor shall be under the terms and conditions of this License, without -any additional terms or conditions. Notwithstanding the above, nothing herein -shall supersede or modify the terms of any separate license agreement you -may have executed with Licensor regarding such Contributions. - -6. Trademarks. This License does not grant permission to use the trade names, -trademarks, service marks, or product names of the Licensor, except as required -for reasonable and customary use in describing the origin of the Work and -reproducing the content of the NOTICE file. - -7. Disclaimer of Warranty. Unless required by applicable law or agreed to -in writing, Licensor provides the Work (and each Contributor provides its -Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -KIND, either express or implied, including, without limitation, any warranties -or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR -A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness -of using or redistributing the Work and assume any risks associated with Your -exercise of permissions under this License. - -8. Limitation of Liability. In no event and under no legal theory, whether -in tort (including negligence), contract, or otherwise, unless required by -applicable law (such as deliberate and grossly negligent acts) or agreed to -in writing, shall any Contributor be liable to You for damages, including -any direct, indirect, special, incidental, or consequential damages of any -character arising as a result of this License or out of the use or inability -to use the Work (including but not limited to damages for loss of goodwill, -work stoppage, computer failure or malfunction, or any and all other commercial -damages or losses), even if such Contributor has been advised of the possibility -of such damages. - -9. Accepting Warranty or Additional Liability. While redistributing the Work -or Derivative Works thereof, You may choose to offer, and charge a fee for, -acceptance of support, warranty, indemnity, or other liability obligations -and/or rights consistent with this License. However, in accepting such obligations, -You may act only on Your own behalf and on Your sole responsibility, not on -behalf of any other Contributor, and only if You agree to indemnify, defend, -and hold each Contributor harmless for any liability incurred by, or claims -asserted against, such Contributor by reason of your accepting any such warranty -or additional liability. END OF TERMS AND CONDITIONS - -APPENDIX: How to apply the Apache License to your work. - -To apply the Apache License to your work, attach the following boilerplate -notice, with the fields enclosed by brackets "[]" replaced with your own identifying -information. (Don't include the brackets!) The text should be enclosed in -the appropriate comment syntax for the file format. We also recommend that -a file or class name and description of purpose be included on the same "printed -page" as the copyright notice for easier identification within third-party -archives. - -Copyright [yyyy] [name of copyright owner] - -Licensed under the Apache License, Version 2.0 (the "License"); - -you may not use this file except in compliance with the License. - -You may obtain a copy of the License at - -http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software - -distributed under the License is distributed on an "AS IS" BASIS, - -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - -See the License for the specific language governing permissions and - -limitations under the License. From 9d2c3ad2e0706d18b79c8458dec58324a5c269cd Mon Sep 17 00:00:00 2001 From: d3xter666 Date: Fri, 4 Sep 2026 17:01:44 +0300 Subject: [PATCH 09/11] revert: Remove obsolete license from lockfile-extractor The LICENSES/Apache-2.0.txt file is required per-package: the REUSE compliance workflow runs with --root lint, so each package needs its own LICENSES/ directory. Restores the file that was incorrectly removed. --- .../LICENSES/Apache-2.0.txt | 208 ++++++++++++++++++ 1 file changed, 208 insertions(+) create mode 100644 internal/lockfile-extractor/LICENSES/Apache-2.0.txt diff --git a/internal/lockfile-extractor/LICENSES/Apache-2.0.txt b/internal/lockfile-extractor/LICENSES/Apache-2.0.txt new file mode 100644 index 00000000000..4ed90b95224 --- /dev/null +++ b/internal/lockfile-extractor/LICENSES/Apache-2.0.txt @@ -0,0 +1,208 @@ +Apache License + +Version 2.0, January 2004 + +http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, +AND DISTRIBUTION + + 1. Definitions. + + + +"License" shall mean the terms and conditions for use, reproduction, and distribution +as defined by Sections 1 through 9 of this document. + + + +"Licensor" shall mean the copyright owner or entity authorized by the copyright +owner that is granting the License. + + + +"Legal Entity" shall mean the union of the acting entity and all other entities +that control, are controlled by, or are under common control with that entity. +For the purposes of this definition, "control" means (i) the power, direct +or indirect, to cause the direction or management of such entity, whether +by contract or otherwise, or (ii) ownership of fifty percent (50%) or more +of the outstanding shares, or (iii) beneficial ownership of such entity. + + + +"You" (or "Your") shall mean an individual or Legal Entity exercising permissions +granted by this License. + + + +"Source" form shall mean the preferred form for making modifications, including +but not limited to software source code, documentation source, and configuration +files. + + + +"Object" form shall mean any form resulting from mechanical transformation +or translation of a Source form, including but not limited to compiled object +code, generated documentation, and conversions to other media types. + + + +"Work" shall mean the work of authorship, whether in Source or Object form, +made available under the License, as indicated by a copyright notice that +is included in or attached to the work (an example is provided in the Appendix +below). + + + +"Derivative Works" shall mean any work, whether in Source or Object form, +that is based on (or derived from) the Work and for which the editorial revisions, +annotations, elaborations, or other modifications represent, as a whole, an +original work of authorship. For the purposes of this License, Derivative +Works shall not include works that remain separable from, or merely link (or +bind by name) to the interfaces of, the Work and Derivative Works thereof. + + + +"Contribution" shall mean any work of authorship, including the original version +of the Work and any modifications or additions to that Work or Derivative +Works thereof, that is intentionally submitted to Licensor for inclusion in +the Work by the copyright owner or by an individual or Legal Entity authorized +to submit on behalf of the copyright owner. For the purposes of this definition, +"submitted" means any form of electronic, verbal, or written communication +sent to the Licensor or its representatives, including but not limited to +communication on electronic mailing lists, source code control systems, and +issue tracking systems that are managed by, or on behalf of, the Licensor +for the purpose of discussing and improving the Work, but excluding communication +that is conspicuously marked or otherwise designated in writing by the copyright +owner as "Not a Contribution." + + + +"Contributor" shall mean Licensor and any individual or Legal Entity on behalf +of whom a Contribution has been received by Licensor and subsequently incorporated +within the Work. + +2. Grant of Copyright License. Subject to the terms and conditions of this +License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable copyright license to reproduce, prepare +Derivative Works of, publicly display, publicly perform, sublicense, and distribute +the Work and such Derivative Works in Source or Object form. + +3. Grant of Patent License. Subject to the terms and conditions of this License, +each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, +no-charge, royalty-free, irrevocable (except as stated in this section) patent +license to make, have made, use, offer to sell, sell, import, and otherwise +transfer the Work, where such license applies only to those patent claims +licensable by such Contributor that are necessarily infringed by their Contribution(s) +alone or by combination of their Contribution(s) with the Work to which such +Contribution(s) was submitted. If You institute patent litigation against +any entity (including a cross-claim or counterclaim in a lawsuit) alleging +that the Work or a Contribution incorporated within the Work constitutes direct +or contributory patent infringement, then any patent licenses granted to You +under this License for that Work shall terminate as of the date such litigation +is filed. + +4. Redistribution. You may reproduce and distribute copies of the Work or +Derivative Works thereof in any medium, with or without modifications, and +in Source or Object form, provided that You meet the following conditions: + +(a) You must give any other recipients of the Work or Derivative Works a copy +of this License; and + +(b) You must cause any modified files to carry prominent notices stating that +You changed the files; and + +(c) You must retain, in the Source form of any Derivative Works that You distribute, +all copyright, patent, trademark, and attribution notices from the Source +form of the Work, excluding those notices that do not pertain to any part +of the Derivative Works; and + +(d) If the Work includes a "NOTICE" text file as part of its distribution, +then any Derivative Works that You distribute must include a readable copy +of the attribution notices contained within such NOTICE file, excluding those +notices that do not pertain to any part of the Derivative Works, in at least +one of the following places: within a NOTICE text file distributed as part +of the Derivative Works; within the Source form or documentation, if provided +along with the Derivative Works; or, within a display generated by the Derivative +Works, if and wherever such third-party notices normally appear. The contents +of the NOTICE file are for informational purposes only and do not modify the +License. You may add Your own attribution notices within Derivative Works +that You distribute, alongside or as an addendum to the NOTICE text from the +Work, provided that such additional attribution notices cannot be construed +as modifying the License. + +You may add Your own copyright statement to Your modifications and may provide +additional or different license terms and conditions for use, reproduction, +or distribution of Your modifications, or for any such Derivative Works as +a whole, provided Your use, reproduction, and distribution of the Work otherwise +complies with the conditions stated in this License. + +5. Submission of Contributions. Unless You explicitly state otherwise, any +Contribution intentionally submitted for inclusion in the Work by You to the +Licensor shall be under the terms and conditions of this License, without +any additional terms or conditions. Notwithstanding the above, nothing herein +shall supersede or modify the terms of any separate license agreement you +may have executed with Licensor regarding such Contributions. + +6. Trademarks. This License does not grant permission to use the trade names, +trademarks, service marks, or product names of the Licensor, except as required +for reasonable and customary use in describing the origin of the Work and +reproducing the content of the NOTICE file. + +7. Disclaimer of Warranty. Unless required by applicable law or agreed to +in writing, Licensor provides the Work (and each Contributor provides its +Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +KIND, either express or implied, including, without limitation, any warranties +or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR +A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness +of using or redistributing the Work and assume any risks associated with Your +exercise of permissions under this License. + +8. Limitation of Liability. In no event and under no legal theory, whether +in tort (including negligence), contract, or otherwise, unless required by +applicable law (such as deliberate and grossly negligent acts) or agreed to +in writing, shall any Contributor be liable to You for damages, including +any direct, indirect, special, incidental, or consequential damages of any +character arising as a result of this License or out of the use or inability +to use the Work (including but not limited to damages for loss of goodwill, +work stoppage, computer failure or malfunction, or any and all other commercial +damages or losses), even if such Contributor has been advised of the possibility +of such damages. + +9. Accepting Warranty or Additional Liability. While redistributing the Work +or Derivative Works thereof, You may choose to offer, and charge a fee for, +acceptance of support, warranty, indemnity, or other liability obligations +and/or rights consistent with this License. However, in accepting such obligations, +You may act only on Your own behalf and on Your sole responsibility, not on +behalf of any other Contributor, and only if You agree to indemnify, defend, +and hold each Contributor harmless for any liability incurred by, or claims +asserted against, such Contributor by reason of your accepting any such warranty +or additional liability. END OF TERMS AND CONDITIONS + +APPENDIX: How to apply the Apache License to your work. + +To apply the Apache License to your work, attach the following boilerplate +notice, with the fields enclosed by brackets "[]" replaced with your own identifying +information. (Don't include the brackets!) The text should be enclosed in +the appropriate comment syntax for the file format. We also recommend that +a file or class name and description of purpose be included on the same "printed +page" as the copyright notice for easier identification within third-party +archives. + +Copyright [yyyy] [name of copyright owner] + +Licensed under the Apache License, Version 2.0 (the "License"); + +you may not use this file except in compliance with the License. + +You may obtain a copy of the License at + +http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software + +distributed under the License is distributed on an "AS IS" BASIS, + +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + +See the License for the specific language governing permissions and + +limitations under the License. From aaff26acd2338dddd5f2cbfa3813fe68266a1ea5 Mon Sep 17 00:00:00 2001 From: d3xter666 Date: Fri, 4 Sep 2026 18:08:30 +0300 Subject: [PATCH 10/11] fix: Update lockfile --- package-lock.json | 572 ---------------------------------------------- 1 file changed, 572 deletions(-) diff --git a/package-lock.json b/package-lock.json index f0db9feecaf..3be0d0d2dfd 100644 --- a/package-lock.json +++ b/package-lock.json @@ -103,7 +103,6 @@ "devDependencies": { "@npmcli/arborist": "^10.0.2", "@npmcli/config": "^11.0.1", - "depcheck": "^1.4.7", "eslint": "^10.9.1", "pacote": "^22.0.0" }, @@ -5726,13 +5725,6 @@ "integrity": "sha512-RGdgjQUZba5p6QEFAVx2OGb8rQDL/cPRG7GiedRzMcJ1tYnUANBncjbSB1NRGwbvjcPeikRABz2nshyPk1bhWg==", "license": "MIT" }, - "node_modules/@types/minimatch": { - "version": "3.0.5", - "resolved": "https://registry.npmjs.org/@types/minimatch/-/minimatch-3.0.5.tgz", - "integrity": "sha512-Klz949h02Gz2uZCMGwDUSDS1YBlTdDDgbWHi+81l29tQALUtvz4rAYi5uoVhE5Lagoq6DeqAUlbrHvW/mXDgdQ==", - "dev": true, - "license": "MIT" - }, "node_modules/@types/node": { "version": "26.1.1", "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.1.tgz", @@ -5758,13 +5750,6 @@ "integrity": "sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA==", "license": "MIT" }, - "node_modules/@types/parse-json": { - "version": "4.0.2", - "resolved": "https://registry.npmjs.org/@types/parse-json/-/parse-json-4.0.2.tgz", - "integrity": "sha512-dISoDXWWQwUquiKsyZ4Ng+HX2KsPL7LyHKHQwgGFEA3IaKac4Obd+h2a/a6waisAoepJlBcx9paWqjA8/HVjCw==", - "dev": true, - "license": "MIT" - }, "node_modules/@types/unist": { "version": "3.0.3", "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz", @@ -6845,16 +6830,6 @@ "url": "https://github.com/sponsors/ljharb" } }, - "node_modules/array-differ": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/array-differ/-/array-differ-3.0.0.tgz", - "integrity": "sha512-THtfYS6KtME/yIAhKjZ2ul7XI96lQGHRputJQHO80LAWQnuGP4iCIN8vdMRboGbIEYBwU33q8Tch1os2+X0kMg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=8" - } - }, "node_modules/array-find-index": { "version": "1.0.2", "resolved": "https://registry.npmjs.org/array-find-index/-/array-find-index-1.0.2.tgz", @@ -6872,16 +6847,6 @@ "dev": true, "license": "MIT" }, - "node_modules/array-union": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/array-union/-/array-union-2.1.0.tgz", - "integrity": "sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=8" - } - }, "node_modules/arraybuffer.prototype.slice": { "version": "1.0.4", "resolved": "https://registry.npmjs.org/arraybuffer.prototype.slice/-/arraybuffer.prototype.slice-1.0.4.tgz", @@ -7652,15 +7617,6 @@ "url": "https://github.com/sponsors/ljharb" } }, - "node_modules/callsite": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/callsite/-/callsite-1.0.0.tgz", - "integrity": "sha512-0vdNRFXn5q+dtOqjfFtmtlI9N2eVZ7LMyEV2iKC5mEEFvSg/69Ml6b/WU2qF8W1nLRa0wiSrDT3Y5jOHZCwKPQ==", - "dev": true, - "engines": { - "node": "*" - } - }, "node_modules/callsites": { "version": "4.2.0", "resolved": "https://registry.npmjs.org/callsites/-/callsites-4.2.0.tgz", @@ -9217,281 +9173,6 @@ "node": ">=0.4.0" } }, - "node_modules/depcheck": { - "version": "1.4.7", - "resolved": "https://registry.npmjs.org/depcheck/-/depcheck-1.4.7.tgz", - "integrity": "sha512-1lklS/bV5chOxwNKA/2XUUk/hPORp8zihZsXflr8x0kLwmcZ9Y9BsS6Hs3ssvA+2wUVbG0U2Ciqvm1SokNjPkA==", - "dev": true, - "license": "MIT", - "dependencies": { - "@babel/parser": "^7.23.0", - "@babel/traverse": "^7.23.2", - "@vue/compiler-sfc": "^3.3.4", - "callsite": "^1.0.0", - "camelcase": "^6.3.0", - "cosmiconfig": "^7.1.0", - "debug": "^4.3.4", - "deps-regex": "^0.2.0", - "findup-sync": "^5.0.0", - "ignore": "^5.2.4", - "is-core-module": "^2.12.0", - "js-yaml": "^3.14.1", - "json5": "^2.2.3", - "lodash": "^4.17.21", - "minimatch": "^7.4.6", - "multimatch": "^5.0.0", - "please-upgrade-node": "^3.2.0", - "readdirp": "^3.6.0", - "require-package-name": "^2.0.1", - "resolve": "^1.22.3", - "resolve-from": "^5.0.0", - "semver": "^7.5.4", - "yargs": "^16.2.0" - }, - "bin": { - "depcheck": "bin/depcheck.js" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/depcheck/node_modules/ansi-regex": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz", - "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=8" - } - }, - "node_modules/depcheck/node_modules/ansi-styles": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz", - "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==", - "dev": true, - "license": "MIT", - "dependencies": { - "color-convert": "^2.0.1" - }, - "engines": { - "node": ">=8" - }, - "funding": { - "url": "https://github.com/chalk/ansi-styles?sponsor=1" - } - }, - "node_modules/depcheck/node_modules/argparse": { - "version": "1.0.10", - "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz", - "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==", - "dev": true, - "license": "MIT", - "dependencies": { - "sprintf-js": "~1.0.2" - } - }, - "node_modules/depcheck/node_modules/balanced-match": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", - "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", - "dev": true, - "license": "MIT" - }, - "node_modules/depcheck/node_modules/brace-expansion": { - "version": "2.1.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", - "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0" - } - }, - "node_modules/depcheck/node_modules/camelcase": { - "version": "6.3.0", - "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz", - "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/depcheck/node_modules/cliui": { - "version": "7.0.4", - "resolved": "https://registry.npmjs.org/cliui/-/cliui-7.0.4.tgz", - "integrity": "sha512-OcRE68cOsVMXp1Yvonl/fzkQOyjLSu/8bhPDfQt0e0/Eb283TKP20Fs2MqoPsr9SwA595rRCA+QMzYc9nBP+JQ==", - "dev": true, - "license": "ISC", - "dependencies": { - "string-width": "^4.2.0", - "strip-ansi": "^6.0.0", - "wrap-ansi": "^7.0.0" - } - }, - "node_modules/depcheck/node_modules/cosmiconfig": { - "version": "7.1.0", - "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-7.1.0.tgz", - "integrity": "sha512-AdmX6xUzdNASswsFtmwSt7Vj8po9IuqXm0UXz7QKPuEUmPB4XyjGfaAr2PSuELMwkRMVH1EpIkX5bTZGRB3eCA==", - "dev": true, - "license": "MIT", - "dependencies": { - "@types/parse-json": "^4.0.0", - "import-fresh": "^3.2.1", - "parse-json": "^5.0.0", - "path-type": "^4.0.0", - "yaml": "^1.10.0" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/depcheck/node_modules/emoji-regex": { - "version": "8.0.0", - "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz", - "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==", - "dev": true, - "license": "MIT" - }, - "node_modules/depcheck/node_modules/is-fullwidth-code-point": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz", - "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=8" - } - }, - "node_modules/depcheck/node_modules/js-yaml": { - "version": "3.15.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz", - "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==", - "dev": true, - "license": "MIT", - "dependencies": { - "argparse": "^1.0.7", - "esprima": "^4.0.0" - }, - "bin": { - "js-yaml": "bin/js-yaml.js" - } - }, - "node_modules/depcheck/node_modules/minimatch": { - "version": "7.4.9", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-7.4.9.tgz", - "integrity": "sha512-Brg/fp/iAVDOQoHxkuN5bEYhyQlZhxddI78yWsCbeEwTHXQjlNLtiJDUsp1GIptVqMI7/gkJMz4vVAc01mpoBw==", - "dev": true, - "license": "ISC", - "dependencies": { - "brace-expansion": "^2.0.2" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/isaacs" - } - }, - "node_modules/depcheck/node_modules/path-type": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz", - "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=8" - } - }, - "node_modules/depcheck/node_modules/string-width": { - "version": "4.2.3", - "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz", - "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==", - "dev": true, - "license": "MIT", - "dependencies": { - "emoji-regex": "^8.0.0", - "is-fullwidth-code-point": "^3.0.0", - "strip-ansi": "^6.0.1" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/depcheck/node_modules/strip-ansi": { - "version": "6.0.1", - "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz", - "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==", - "dev": true, - "license": "MIT", - "dependencies": { - "ansi-regex": "^5.0.1" - }, - "engines": { - "node": ">=8" - } - }, - "node_modules/depcheck/node_modules/wrap-ansi": { - "version": "7.0.0", - "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz", - "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==", - "dev": true, - "license": "MIT", - "dependencies": { - "ansi-styles": "^4.0.0", - "string-width": "^4.1.0", - "strip-ansi": "^6.0.0" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/chalk/wrap-ansi?sponsor=1" - } - }, - "node_modules/depcheck/node_modules/yaml": { - "version": "1.10.3", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.3.tgz", - "integrity": "sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA==", - "dev": true, - "license": "ISC", - "engines": { - "node": ">= 6" - } - }, - "node_modules/depcheck/node_modules/yargs": { - "version": "16.2.2", - "resolved": "https://registry.npmjs.org/yargs/-/yargs-16.2.2.tgz", - "integrity": "sha512-Nt9ZJjXTv5R8MHbqby/wXQ6Gi0Bb3TcYZkR1bzuL4yB2OxWPkXknz513gEF0GoA6tn00UpbPvERW8rzCuWCA6w==", - "dev": true, - "license": "MIT", - "dependencies": { - "cliui": "^7.0.2", - "escalade": "^3.1.1", - "get-caller-file": "^2.0.5", - "require-directory": "^2.1.1", - "string-width": "^4.2.0", - "y18n": "^5.0.5", - "yargs-parser": "^20.2.2" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/depcheck/node_modules/yargs-parser": { - "version": "20.2.9", - "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-20.2.9.tgz", - "integrity": "sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==", - "dev": true, - "license": "ISC", - "engines": { - "node": ">=10" - } - }, "node_modules/depd": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz", @@ -9501,13 +9182,6 @@ "node": ">= 0.8" } }, - "node_modules/deps-regex": { - "version": "0.2.0", - "resolved": "https://registry.npmjs.org/deps-regex/-/deps-regex-0.2.0.tgz", - "integrity": "sha512-PwuBojGMQAYbWkMXOY9Pd/NWCDNHVH12pnS7WHqZkTSeMESe4hwnKKRp0yR87g37113x4JPbo/oIvXY+s/f56Q==", - "dev": true, - "license": "MIT" - }, "node_modules/dequal": { "version": "2.0.3", "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz", @@ -9518,16 +9192,6 @@ "node": ">=6" } }, - "node_modules/detect-file": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/detect-file/-/detect-file-1.0.0.tgz", - "integrity": "sha512-DtCOLG98P007x7wiiOmfI0fi3eIKyWiLTGJ2MDnVi/E04lWGbf+JzrRHMm0rgIIZJGtHpKpbVgLWHrv8xXpc3Q==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.10.0" - } - }, "node_modules/detect-libc": { "version": "2.1.2", "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz", @@ -10668,19 +10332,6 @@ "url": "https://github.com/sindresorhus/execa?sponsor=1" } }, - "node_modules/expand-tilde": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/expand-tilde/-/expand-tilde-2.0.2.tgz", - "integrity": "sha512-A5EmesHW6rfnZ9ysHQjPdJRni0SRar0tjtG5MNtm9n5TUvsYU8oozprtRD4AqHxcZWWlVuAmQo2nWKfN9oyjTw==", - "dev": true, - "license": "MIT", - "dependencies": { - "homedir-polyfill": "^1.0.1" - }, - "engines": { - "node": ">=0.10.0" - } - }, "node_modules/exponential-backoff": { "version": "3.1.3", "resolved": "https://registry.npmjs.org/exponential-backoff/-/exponential-backoff-3.1.3.tgz", @@ -11015,22 +10666,6 @@ "url": "https://github.com/sponsors/sindresorhus" } }, - "node_modules/findup-sync": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/findup-sync/-/findup-sync-5.0.0.tgz", - "integrity": "sha512-MzwXju70AuyflbgeOhzvQWAvvQdo1XL0A9bVvlXsYcFEBM87WR4OakL4OfZq+QRmr+duJubio+UtNQCPsVESzQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "detect-file": "^1.0.0", - "is-glob": "^4.0.3", - "micromatch": "^4.0.4", - "resolve-dir": "^1.0.1" - }, - "engines": { - "node": ">= 10.13.0" - } - }, "node_modules/flat-cache": { "version": "4.0.1", "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-4.0.1.tgz", @@ -11494,65 +11129,6 @@ "url": "https://github.com/sponsors/sindresorhus" } }, - "node_modules/global-modules": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/global-modules/-/global-modules-1.0.0.tgz", - "integrity": "sha512-sKzpEkf11GpOFuw0Zzjzmt4B4UZwjOcG757PPvrfhxcLFbq0wpsgpOqxpxtxFiCG4DtG93M6XRVbF2oGdev7bg==", - "dev": true, - "license": "MIT", - "dependencies": { - "global-prefix": "^1.0.1", - "is-windows": "^1.0.1", - "resolve-dir": "^1.0.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/global-prefix": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/global-prefix/-/global-prefix-1.0.2.tgz", - "integrity": "sha512-5lsx1NUDHtSjfg0eHlmYvZKv8/nVqX4ckFbM+FrGcQ+04KWcWFo9P5MxPZYSzUvyzmdTbI7Eix8Q4IbELDqzKg==", - "dev": true, - "license": "MIT", - "dependencies": { - "expand-tilde": "^2.0.2", - "homedir-polyfill": "^1.0.1", - "ini": "^1.3.4", - "is-windows": "^1.0.1", - "which": "^1.2.14" - }, - "engines": { - "node": ">=0.10.0" - } - }, - "node_modules/global-prefix/node_modules/ini": { - "version": "1.3.8", - "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz", - "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==", - "dev": true, - "license": "ISC" - }, - "node_modules/global-prefix/node_modules/isexe": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz", - "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==", - "dev": true, - "license": "ISC" - }, - "node_modules/global-prefix/node_modules/which": { - "version": "1.3.1", - "resolved": "https://registry.npmjs.org/which/-/which-1.3.1.tgz", - "integrity": "sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==", - "dev": true, - "license": "ISC", - "dependencies": { - "isexe": "^2.0.0" - }, - "bin": { - "which": "bin/which" - } - }, "node_modules/globals": { "version": "17.11.0", "resolved": "https://registry.npmjs.org/globals/-/globals-17.11.0.tgz", @@ -11812,19 +11388,6 @@ "url": "https://opencollective.com/unified" } }, - "node_modules/homedir-polyfill": { - "version": "1.0.3", - "resolved": "https://registry.npmjs.org/homedir-polyfill/-/homedir-polyfill-1.0.3.tgz", - "integrity": "sha512-eSmmWE5bZTK2Nou4g0AI3zZ9rswp7GRKoKXS1BLUkvPviOqs4YTN1djQIqrXy9k5gEtdLPy86JjRwsNM9tnDcA==", - "dev": true, - "license": "MIT", - "dependencies": { - "parse-passwd": "^1.0.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, "node_modules/hookable": { "version": "5.5.3", "resolved": "https://registry.npmjs.org/hookable/-/hookable-5.5.3.tgz", @@ -14684,67 +14247,6 @@ "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==", "license": "MIT" }, - "node_modules/multimatch": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/multimatch/-/multimatch-5.0.0.tgz", - "integrity": "sha512-ypMKuglUrZUD99Tk2bUQ+xNQj43lPEfAeX2o9cTteAmShXy2VHDJpuwu1o0xqoKCt9jLVAvwyFKdLTPXKAfJyA==", - "dev": true, - "license": "MIT", - "dependencies": { - "@types/minimatch": "^3.0.3", - "array-differ": "^3.0.0", - "array-union": "^2.1.0", - "arrify": "^2.0.1", - "minimatch": "^3.0.4" - }, - "engines": { - "node": ">=10" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/multimatch/node_modules/arrify": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/arrify/-/arrify-2.0.1.tgz", - "integrity": "sha512-3duEwti880xqi4eAMN8AyR4a0ByT90zoYdLlevfrvU43vb0YZwZVfxOgxWrLXXXpyugL0hNZc9G6BiB5B3nUug==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=8" - } - }, - "node_modules/multimatch/node_modules/balanced-match": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", - "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", - "dev": true, - "license": "MIT" - }, - "node_modules/multimatch/node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0", - "concat-map": "0.0.1" - } - }, - "node_modules/multimatch/node_modules/minimatch": { - "version": "3.1.5", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz", - "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==", - "dev": true, - "license": "ISC", - "dependencies": { - "brace-expansion": "^1.1.7" - }, - "engines": { - "node": "*" - } - }, "node_modules/nanoid": { "version": "3.3.18", "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", @@ -15784,16 +15286,6 @@ "url": "https://github.com/sponsors/sindresorhus" } }, - "node_modules/parse-passwd": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/parse-passwd/-/parse-passwd-1.0.0.tgz", - "integrity": "sha512-1Y1A//QUXEZK7YKz+rD9WydcE1+EuPr6ZBgKecAB8tmoW6UFv0NREVJe1p+jRxtThkcbbKkfwIbWJe/IeE6m2Q==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.10.0" - } - }, "node_modules/parse-statements": { "version": "1.0.11", "resolved": "https://registry.npmjs.org/parse-statements/-/parse-statements-1.0.11.tgz", @@ -15980,16 +15472,6 @@ "node": ">=8" } }, - "node_modules/please-upgrade-node": { - "version": "3.2.0", - "resolved": "https://registry.npmjs.org/please-upgrade-node/-/please-upgrade-node-3.2.0.tgz", - "integrity": "sha512-gQR3WpIgNIKwBMVLkpMUeR3e1/E1y42bqDQZfql+kDeXd8COYfM8PQA4X6y7a8u9Ua9FHmsrrmirW2vHs45hWg==", - "dev": true, - "license": "MIT", - "dependencies": { - "semver-compare": "^1.0.0" - } - }, "node_modules/plur": { "version": "6.0.0", "resolved": "https://registry.npmjs.org/plur/-/plur-6.0.0.tgz", @@ -16981,32 +16463,6 @@ "node": ">= 6" } }, - "node_modules/readdirp": { - "version": "3.6.0", - "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz", - "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==", - "dev": true, - "license": "MIT", - "dependencies": { - "picomatch": "^2.2.1" - }, - "engines": { - "node": ">=8.10.0" - } - }, - "node_modules/readdirp/node_modules/picomatch": { - "version": "2.3.2", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz", - "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=8.6" - }, - "funding": { - "url": "https://github.com/sponsors/jonschlinkert" - } - }, "node_modules/readline-transform": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/readline-transform/-/readline-transform-1.0.0.tgz", @@ -17154,13 +16610,6 @@ "dev": true, "license": "ISC" }, - "node_modules/require-package-name": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/require-package-name/-/require-package-name-2.0.1.tgz", - "integrity": "sha512-uuoJ1hU/k6M0779t3VMVIYpb2VMJk05cehCaABFhXaibcbvfgR8wKiozLjVFSzJPmQMRqIcO0HMyTFqfV09V6Q==", - "dev": true, - "license": "MIT" - }, "node_modules/requizzle": { "version": "0.2.4", "resolved": "https://registry.npmjs.org/requizzle/-/requizzle-0.2.4.tgz", @@ -17216,20 +16665,6 @@ "node": ">=8" } }, - "node_modules/resolve-dir": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/resolve-dir/-/resolve-dir-1.0.1.tgz", - "integrity": "sha512-R7uiTjECzvOsWSfdM0QKFNBVFcK27aHOUwdvK53BcW8zqnGdYp0Fbj82cy54+2A4P2tFM22J5kRfe1R+lM/1yg==", - "dev": true, - "license": "MIT", - "dependencies": { - "expand-tilde": "^2.0.0", - "global-modules": "^1.0.0" - }, - "engines": { - "node": ">=0.10.0" - } - }, "node_modules/resolve-from": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz", @@ -17518,13 +16953,6 @@ "node": ">=10" } }, - "node_modules/semver-compare": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/semver-compare/-/semver-compare-1.0.0.tgz", - "integrity": "sha512-YM3/ITh2MJ5MtzaM429anh+x2jiLVjqILF4m4oyQB18W7Ggea7BfqdH/wGMK7dDiMghv/6WG7znWMwUDzJiXow==", - "dev": true, - "license": "MIT" - }, "node_modules/send": { "version": "1.2.1", "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz", From a48a15e1a9cfac6b87d34f6b138e9a25aaec42c8 Mon Sep 17 00:00:00 2001 From: d3xter666 Date: Fri, 4 Sep 2026 20:50:15 +0300 Subject: [PATCH 11/11] fix: Respect the new root package when resolving nodes --- .../lib/extractFromWorkspaceLockfile.js | 34 ++++++++++++++ .../package-lock.fixture.json | 46 +++++++++++++++++++ .../test/lib/extractFromWorkspaceLockfile.js | 15 ++++++ 3 files changed, 95 insertions(+) create mode 100644 internal/lockfile-extractor/test/fixture/target-root-collision/package-lock.fixture.json diff --git a/internal/lockfile-extractor/lib/extractFromWorkspaceLockfile.js b/internal/lockfile-extractor/lib/extractFromWorkspaceLockfile.js index a6bb88a4222..198fee0fdcf 100644 --- a/internal/lockfile-extractor/lib/extractFromWorkspaceLockfile.js +++ b/internal/lockfile-extractor/lib/extractFromWorkspaceLockfile.js @@ -60,6 +60,7 @@ export default async function extractFromWorkspaceLockfile(workspaceRootDir, tar // Using the keys, extract relevant package-entries from package-lock.json const extractedPackages = Object.create(null); + const extractedPackageNodes = new Map(); for (let [packageLoc, node] of relevantPackageLocations) { let pkg = packageLockJson.packages[packageLoc]; if (pkg.link) { @@ -82,7 +83,24 @@ export default async function extractFromWorkspaceLockfile(workspaceRootDir, tar pkg.resolved = resolved; pkg.integrity = integrity; } + const existingNode = extractedPackageNodes.get(packageLoc); + if (existingNode && + (existingNode.packageName !== node.packageName || existingNode.version !== node.version)) { + const existingIsFromTarget = isDirectDependencyOf(existingNode, targetPackageName); + const currentIsFromTarget = isDirectDependencyOf(node, targetPackageName); + if (existingIsFromTarget !== currentIsFromTarget) { + if (currentIsFromTarget) { + nestPackageBelowDependents(existingNode, extractedPackages[packageLoc], extractedPackages, + relevantPackageLocations, targetPackageName, tree.packageName); + } else { + nestPackageBelowDependents(node, pkg, extractedPackages, relevantPackageLocations, + targetPackageName, tree.packageName); + continue; + } + } + } extractedPackages[packageLoc] = pkg; + extractedPackageNodes.set(packageLoc, node); } // Sort packages by key to ensure consistent order (just like the npm cli does it) @@ -129,6 +147,22 @@ function normalizePackageLocation(location, node, targetPackageName, rootPackage return location; } +function nestPackageBelowDependents(node, pkg, extractedPackages, relevantPackageLocations, + targetPackageName, rootPackageName) { + for (const edge of node.edgesIn) { + if (edge.dev || !relevantPackageLocations.has(edge.from.location)) { + continue; + } + const parentLoc = normalizePackageLocation(edge.from.location, edge.from, + targetPackageName, rootPackageName); + extractedPackages[`${parentLoc}/node_modules/${edge.name}`] = pkg; + } +} + +function isDirectDependencyOf(node, packageName) { + return Array.from(node.edgesIn).some((edge) => !edge.dev && edge.from.packageName === packageName); +} + function collectDependencies(node, relevantPackageLocations) { if (relevantPackageLocations.has(node.location)) { // Already processed diff --git a/internal/lockfile-extractor/test/fixture/target-root-collision/package-lock.fixture.json b/internal/lockfile-extractor/test/fixture/target-root-collision/package-lock.fixture.json new file mode 100644 index 00000000000..24a83d2352a --- /dev/null +++ b/internal/lockfile-extractor/test/fixture/target-root-collision/package-lock.fixture.json @@ -0,0 +1,46 @@ +{ + "name": "fixture-workspace", + "version": "1.0.0", + "lockfileVersion": 3, + "requires": true, + "packages": { + "": { + "name": "fixture-workspace", + "version": "1.0.0", + "workspaces": [ + "packages/cli" + ] + }, + "node_modules/@ui5/cli": { + "resolved": "packages/cli", + "link": true + }, + "node_modules/boxen": { + "version": "8.0.1", + "dependencies": { + "chalk": "^5.3.0" + } + }, + "node_modules/chalk": { + "version": "5.6.2" + }, + "node_modules/update-notifier": { + "version": "7.3.1", + "dependencies": { + "boxen": "^8.0.1", + "chalk": "^5.3.0" + } + }, + "packages/cli": { + "name": "@ui5/cli", + "version": "1.0.0", + "dependencies": { + "chalk": "^6.0.0", + "update-notifier": "^7.3.1" + } + }, + "packages/cli/node_modules/chalk": { + "version": "6.0.0" + } + } +} \ No newline at end of file diff --git a/internal/lockfile-extractor/test/lib/extractFromWorkspaceLockfile.js b/internal/lockfile-extractor/test/lib/extractFromWorkspaceLockfile.js index 0086321fcac..05d0ea04f5b 100644 --- a/internal/lockfile-extractor/test/lib/extractFromWorkspaceLockfile.js +++ b/internal/lockfile-extractor/test/lib/extractFromWorkspaceLockfile.js @@ -227,6 +227,21 @@ test("Optional peer dependencies with null edges should be excluded", async (t) "utf-8-validate (optional peerDep of ws) must not be included"); }); +test("Direct target dependencies take precedence at the root", async (t) => { + const mockRestore = setupPacoteMock(); + t.after(() => mockRestore()); + + const cwd = path.join(import.meta.dirname, "..", "fixture", "target-root-collision"); + const symlinkPath = await setupFixtureSymlink(cwd); + t.after(async () => await unlink(symlinkPath).catch(() => {})); + + const lockfileJson = await extractFromWorkspaceLockfile(cwd, "@ui5/cli"); + + assert.equal(lockfileJson.packages["node_modules/chalk"].version, "6.0.0"); + assert.equal(lockfileJson.packages["node_modules/update-notifier/node_modules/chalk"].version, "5.6.2"); + assert.equal(lockfileJson.packages["node_modules/boxen/node_modules/chalk"].version, "5.6.2"); +}); + // Error handling tests test("Error handling - invalid target package name", async (t) => { const __dirname = import.meta.dirname;