package-lock.json missing resolved & integrity fields

[felschr]

Hi, while trying to package protoc-gen-connect-es for nixpkgs, I've ran into the issue that the package-lock.json doesn't contain any resolved & integrity fields since 411bba5: NixOS/nixpkgs#243432 (comment)
These fieldd should exist according to the docs: https://docs.npmjs.com/cli/v9/configuring-npm/package-lock-json

This can likely be fixed by regenerating the lock file from scratch and/or updating to newer versions of npm.

I've also found the same issue with protobuf-es: bufbuild/protobuf-es#526

[timostamm]

@felschr, I'm not entirely sure what commands @smaye81 ran, but my guess is that the fields were removed from the lock
file by re-generating it.

If you run the following commands:

$ npm --version            
9.8.0
$ rm -rf package-lock.json 
$ npm install

The lock-file is re-created, and all resolved and integrity fields are removed from the lock file. In this case, we removed a package from the repository, and the alternative to the commands above would be to edit the lock file manually, or to delete the node_modules directory as well before running npm install. The latter will also bump versions within the defined constraints.

I think it might not be completely uncommon to have lock files without those fields in the wild because of this behavior of npm...

Do you know an alternative in situations like this that retains the fields?

[smaye81]

Just to confirm -- I used npm version 9.5.0 when regenerating the lock file.

[lilyinstarlight]

Regenerating the lockfile should be adding those fields, not removing them. I just confirmed that locally with npm 9.7.2 -- removing the lockfile and doing npm install adds those fields correctly

Can you share the output of npm config list so we can check if you have some local setting that is causing that?

[lilyinstarlight]

Oh there's an upstream issue for it. You might have to remove both node_modules and package-lock.json to get it to correctly regenerate. See npm/cli#6301

[smaye81]

I just created #720 to regenerate package-lock.json using the instructions in npm/cli#6301. Let me know if this is what is needed to satisfy the nixpkgs issue.

Also please note that we can't guarantee this won't happen again due to the open npm cli issue. We aren't committing to manually ensuring the lock file always has these properties. Hopefully the issue on the npm side is resolved soon.

[smaye81]

Also related fix in Protobuf-ES: bufbuild/protobuf-es#527

[felschr]

@smaye81 Thank you for the quick fix and the new release of protobuf-es!

[felschr]

npm issues that track the problem of missing integrity & resolved fields:
npm/cli#4263, npm/cli#4460 npm/cli#6301

Issue on protobuf-es to track this issue and hopefully find a long-term solution:
bufbuild/protobuf-es#589