feat: rebuilt package-lock w/ v2

[erisu]

Motivation and Context

Prepare for Cordova CLI 11 Release

Description

Rebuilt the package-lock.json file with v2

Testing

• GH Actions

Checklist

• I've run the tests to see all new and existing tests pass

[codecov-commenter]

Codecov Report

Merging #570 (b49f1cc) into master (b164b33) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #570   +/-   ##
=======================================
  Coverage   70.40%   70.40%           
=======================================
  Files           4        4           
  Lines         321      321           
=======================================
  Hits          226      226           
  Misses         95       95           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b164b33...b49f1cc. Read the comment docs.

[timbru31]

Does this have any implications for Node.js versions that still use v1?

[erisu]

Some points about the package-lock is that is apart of NPM's structure, not Node.js.

People could have installed an older Node.js and installed the latest NPM with npm i -g npm@latest.

The package-lock is a development file and never bundled with the production release package.

About the version support, https://docs.npmjs.com/cli/v7/configuring-npm/package-lock-json#lockfileversion

Note that the file format changed significantly in npm v7 to track information that would have otherwise required looking in node_modules or the npm registry. Lockfiles generated by npm v7 will contain lockfileVersion: 2.

No version provided: an "ancient" shrinkwrap file from a version of npm prior to npm v5.

1: The lockfile version used by npm v5 and v6.
2: The lockfile version used by npm v7, which is backwards compatible to v1 lockfiles.
3: The lockfile version used by npm v7, without backwards compatibility affordances. This is used for the hidden lockfile at node_modules/.package-lock.json, and will likely be used in a future version of npm, once support for npm v6 is no longer relevant.

npm will always attempt to get whatever data it can out of a lockfile, even if it is not a version that it was designed to support.

[erisu]

@timbru31, I hope the above explains enough.

But, here is also the parent ticket to direct this change: apache/cordova#300
This was also discussed in the mailing list and the link is in the above ticket.