Conversation
|
🎉 A review copy of this PR has been deployed! It is made of up two components Important Not all of the functionality of forms-runner is present in review apps. You should use the full dev environment to test the functionality which is disabled here. It may take 5 minutes or so for the application to be fully deployed and working. If it still isn't ready For the sign in details and more information, see the review apps wiki page. |
There was a bug in npm v11.6.0 and prior that would mark dependencies as peer dependencies incorrectly (see npm/cli#8579). This was fixed in v11.6.1 (see the [npm changelog], but it seems that at some point our package lockfile was updated with incorrectly marked peer dependencies, and now when we run `npm install` on our machines with the latest version of npm it updates the package lockfile to remove the marks, leading to noise in git. This commit updates the package lockfile with the (hopefully) correct peer dependency marks. I don't think we need to worry about Dependabot changing things back, as looking at the logs of a [recent Dependabot run] it looks like that is now using npm v11.6.2. [npm changelog]: https://github.com/npm/cli/blob/latest/CHANGELOG.md#1161-2025-09-23 [recent Dependabot run]: https://github.com/alphagov/forms-runner/actions/runs/20049289324/job/57501554830
f03d73b to
e843d2f
Compare
|



What problem does this pull request solve?
There was a bug in npm v11.6.0 and prior that would mark dependencies as peer dependencies incorrectly (see npm/cli#8579). This was fixed in v11.6.1 (see the npm changelog, but it seems that at some point our package lockfile was updated with incorrectly marked peer dependencies, and now when we run
npm installon our machines with the latest version of npm it updates the package lockfile to remove the marks, leading to noise in git.This commit updates the package lockfile with the (hopefully) correct peer dependency marks.
I don't think we need to worry about Dependabot changing things back, as looking at the logs of a recent Dependabot run it looks like that is now using npm v11.6.2.
Note
Note to devs: if you find your local machine adding
peer: trueto the package lockfiles (and not making any other changes), make sure to runnpm install -g npm@latestif running Node locally, and/ordocker compose build --no-cacheif using Docker Compose.Things to consider when reviewing