feat: make lockfileVersion configurable

This will tell Arborist to save an appropriate lockfile based on
the version specified.

Version 3 = packages section only
Version 2 = packages and dependencies sections (default)
Version 1 = dependencies section only (legacy npm v6 support)

Re: npm/rfcs#434

bin/shrinkwrap.js

@@ -5,7 +5,7 @@ require('./lib/timers.js')
 
 const { quiet } = options
 Shrinkwrap.load(options)
-  .then(s => quiet || console.log(JSON.stringify(s.data, 0, 2)))
+  .then(s => quiet || console.log(JSON.stringify(s.commit(), 0, 2)))
   .catch(er => {
     console.error('shrinkwrap load failure', er)
     process.exit(1)

lib/arborist/build-ideal-tree.js

@@ -307,8 +307,10 @@ module.exports = cls => class IdealTreeBuilder extends cls {
       // reconstructing it anyway.
       .then(root => this[_global] ? root
       : !this[_usePackageLock] || this[_updateAll]
-        ? Shrinkwrap.reset({ path: this.path })
-          .then(meta => Object.assign(root, {meta}))
+        ? Shrinkwrap.reset({
+          path: this.path,
+          lockfileVersion: this.options.lockfileVersion,
+        }).then(meta => Object.assign(root, {meta}))
         : this.loadVirtual({ root }))
 
       // if we don't have a lockfile to go from, then start with the
@@ -345,7 +347,10 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     // this is a gross kludge to handle the fact that we don't save
     // metadata on the root node in global installs, because the "root"
     // node is something like /usr/local/lib.
-    const meta = new Shrinkwrap({ path: this.path })
+    const meta = new Shrinkwrap({
+      path: this.path,
+      lockfileVersion: this.options.lockfileVersion,
+    })
     meta.reset()
     root.meta = meta
     return root

lib/arborist/load-actual.js

@@ -145,13 +145,15 @@ module.exports = cls => class ActualLoader extends cls {
     const meta = await Shrinkwrap.load({
       path: this[_actualTree].path,
       hiddenLockfile: true,
+      lockfileVersion: 3,
     })
     if (meta.loadedFromDisk) {
       this[_actualTree].meta = meta
       return this[_loadActualVirtually]({ root })
     } else {
       const meta = await Shrinkwrap.load({
         path: this[_actualTree].path,
+        lockfileVersion: this.options.lockfileVersion,
       })
       this[_actualTree].meta = meta
       return this[_loadActualActually]({ root, ignoreMissing })

lib/arborist/load-virtual.js

@@ -54,7 +54,10 @@ module.exports = cls => class VirtualLoader extends cls {
       return treeCheck(this.virtualTree)
     }
 
-    const s = await Shrinkwrap.load({ path: this.path })
+    const s = await Shrinkwrap.load({
+      path: this.path,
+      lockfileVersion: this.options.lockfileVersion,
+    })
     if (!s.loadedFromDisk && !options.root) {
       const er = new Error('loadVirtual requires existing shrinkwrap file')
       throw Object.assign(er, { code: 'ENOLOCK' })

lib/shrinkwrap.js

@@ -10,7 +10,7 @@
 // definitely not before npm v8.
 
 const localeCompare = require('@isaacs/string-locale-compare')('en')
-const lockfileVersion = 2
+const defaultLockfileVersion = 2
 
 // for comparing nodes to yarn.lock entries
 const mismatch = (a, b) => a && b && a !== b
@@ -316,8 +316,10 @@ class Shrinkwrap {
       shrinkwrapOnly = false,
       hiddenLockfile = false,
       log = procLog,
+      lockfileVersion = defaultLockfileVersion,
     } = options
 
+    this.lockfileVersion = parseInt(hiddenLockfile ? 3 : lockfileVersion, 10)
     this.log = log
     this[_awaitingUpdate] = new Map()
     this.tree = null
@@ -372,9 +374,9 @@ class Shrinkwrap {
   reset () {
     this.tree = null
     this[_awaitingUpdate] = new Map()
-    this.originalLockfileVersion = lockfileVersion
+    this.originalLockfileVersion = this.lockfileVersion
     this.data = {
-      lockfileVersion,
+      lockfileVersion: this.lockfileVersion,
       requires: true,
       packages: {},
       dependencies: {},
@@ -462,11 +464,12 @@ class Shrinkwrap {
     }).then(lock => {
       this.data = {
         ...lock,
-        lockfileVersion,
+        lockfileVersion: this.lockfileVersion,
         requires: true,
         packages: lock.packages || {},
-        ...(this.hiddenLockfile ? {} : {dependencies: lock.dependencies || {}}),
+        dependencies: lock.dependencies || {},
       }
+
       this.originalLockfileVersion = lock.lockfileVersion
       this.ancientLockfile = this.loadedFromDisk &&
         !(lock.lockfileVersion >= 2) && !lock.requires
@@ -886,7 +889,17 @@ class Shrinkwrap {
       this[_buildLegacyLockfile](this.tree, this.data)
     }
 
-    return this.data
+    const data = { ...this.data }
+    // lf version 1 = dependencies only
+    // lf version 2 = dependencies and packages
+    // lf version 3 = packages only
+    if (this.lockfileVersion >= 3) {
+      delete data.dependencies
+    } else if (this.lockfileVersion < 2) {
+      delete data.packages
+    }
+
+    return data
   }
 
   [_buildLegacyLockfile] (node, lock, path = []) {

tap-snapshots/test/shrinkwrap.js.test.cjs

@@ -692,7 +692,8 @@ Object {
 
 exports[`test/shrinkwrap.js TAP load a hidden lockfile > must match snapshot 1`] = `
 Object {
-  "lockfileVersion": 2,
+  "dependencies": Object {},
+  "lockfileVersion": 3,
   "name": "hidden-lockfile",
   "packages": Object {
     "": Object {

test/shrinkwrap.js

@@ -38,6 +38,22 @@ t.test('path defaults to .', async t => {
   t.equal(sw.path, process.cwd())
 })
 
+t.test('load and change lockfileVersion', async t => {
+  const vDefault = await Shrinkwrap.load({ path: fixture })
+  const v1 = await Shrinkwrap.load({ path: fixture, lockfileVersion: 1 })
+  const v2 = await Shrinkwrap.load({ path: fixture, lockfileVersion: 2 })
+  const v3 = await Shrinkwrap.load({ path: fixture, lockfileVersion: 3 })
+
+  t.strictSame(vDefault, v2, 'default is same as version 2')
+  const v1Data = await v1.commit()
+  const v2Data = await v2.commit()
+  const v3Data = await v3.commit()
+  t.strictSame(v2Data, { ...v1Data, ...v3Data, lockfileVersion: 2 },
+    'v2 is superset of v1 and v3')
+  t.equal(v1Data.packages, undefined, 'v1 data does not have packages')
+  t.equal(v3Data.dependencies, undefined, 'v3 data does not have dependencies')
+})
+
 t.test('load and then reset gets empty lockfile', t =>
   Shrinkwrap.load({ path: fixture }).then(sw => {
     sw.reset()
@@ -680,9 +696,9 @@ t.test('load a hidden lockfile', t => {
       },
     }))
     t.strictSame(s.data.dependencies, {}, 'did not add to legacy data')
-    s.commit()
-    t.equal(s.data.packages[''], undefined, 'no root entry')
-    t.equal(s.data.dependencies, undefined, 'deleted legacy metadata')
+    const data = s.commit()
+    t.equal(data.packages[''], undefined, 'no root entry')
+    t.equal(data.dependencies, undefined, 'deleted legacy metadata')
   })
 })
 
@@ -691,7 +707,7 @@ t.test('load a fresh hidden lockfile', t => Shrinkwrap.reset({
   hiddenLockfile: true,
 }).then(sw => {
   t.strictSame(sw.data, {
-    lockfileVersion: 2,
+    lockfileVersion: 3,
     requires: true,
     dependencies: {},
     packages: {},