[TikiWiki-commits] [Git][tikiwiki/tiki][master] [FIX] Remove nested node_modules when running npm install
"ushindi bienvenu \(@usbbush\) via TikiWiki-cvs" <[email protected]>
| Newsgroups | gmane.comp.cms.tiki.cvs |
|---|---|
| Message-ID | <69354e1bd13de_2a17c8709675b@gitlab-sidekiq-low-urgency-cpu-bound-v2-78d969c448-nqkhv.mail> |
ushindi bienvenu pushed to branch master at Tiki Wiki CMS Groupware / Tiki
Commits:
107413fc by ushindi bienvenu at 2025-12-07T09:43:28+00:00
[FIX] Remove nested node_modules when running npm install
---
* [FIX] Remove nested node_modules
See merge request tikiwiki/tiki!8853
- - - - -
2 changed files:
- package-lock.json
- package.json
Changes:
=====================================
package-lock.json
=====================================
The diff for this file was not included because it is too large.
=====================================
package.json
=====================================
@@ -1,116 +1,130 @@
{
- "//": [
- "Note about updating package.json:",
- "The behaviour of package-lock.json files upon running npm install has many subtleties, that are not especially obvious.",
- "The short version is that when you update package.json, you have two general choices to get package-lock.json up to date.",
- "1- Just run: ",
- " npm install",
- " It will update package-lock.json to meet the constraints, but not touch any installed package that already meets the constraints. So it's a minimal impact update",
- "2- Run:",
- " npm update",
- " This will update ALL packages including transitive dependencies to the latest version that meet the semver in package.json.",
- "To regenerate package-lock.json from scratch, run:",
- " rm -r package-lock.json node_modules/;npm install",
- "The above should have the same results as npm update, but that isn't always exactly the case."
- ],
- "name": "tiki",
- "version": "0.0.1",
- "type": "module",
- "scriptsComments": {
- "checkEnvironment:validNodeModules": "The idea is to stop everything if a dev updated from git and forgot to run npm install. npm ls will do that (we check it's return code). Unfortunately it is verbose (no easy cross platform way to suppress the output and keep the return code) and takes almost as long to run as a npm install... Maybe just keep it until PHP developers get used to re-running composer and node - benoitg - 2023-11-24."
- },
- "scripts": {
- "checkEnvironment:engine": "node src/js/build_utils/engineCheck.js",
- "checkEnvironment:validNodeModules": "npm ls",
- "checkEnvironmentComment": "The idea is to emulate running all processes sequentially with && (fail if any return a non zero exit code), but be compatible with the different shells on windows",
- "checkEnvironment": "run-s --print-label \"checkEnvironment:*\"",
- "prebuild": "run-s --print-label \"checkEnvironment\"",
- "build:generateIconList": "node lib/iconGeneratorNodeWrapper.js",
- "build:js": "vite --config=src/js/vite.config.mjs build --mode=production",
- "build:scss": "npm run build -w src/scss",
- "build:_custom": "copy-and-watch '_custom/**/themes/**/*.{woff,woff2,ttf,otf,svg,png,gif,jpg}' '_custom/**/{lang,js}/**/*.{js,mjs}' public/generated/_custom",
- "build": "concurrently --kill-others-on-fail \"npm:build:*\"",
- "prewatch": "npm run checkEnvironment",
- "watch:generateIconList": "npm run build:generateIconList",
- "watch:js": "vite --config=src/js/vite.config.mjs build --watch --mode=development",
- "watch:scss": "npm run watch -w src/scss",
- "watch:_custom": "copy-and-watch --watch '_custom/**/themes/**/*.{woff,woff2,ttf,otf,svg,png,gif,jpg}' '_custom/**/{lang,js}/**/*.{js,mjs}' public/generated/_custom",
- "watch": "concurrently --kill-others-on-fail \"npm:watch:*\"",
- "lint": "eslint --ext .js,.vue --ignore-path .gitignore --fix src",
- "format": "prettier . --write",
- "clean:wsconf": "php console.php dev:buildwsconfs --clean",
- "clean:scss": "npm run clean -w src/scss",
- "clean": "concurrently \"npm:clean:*\"",
- "test": "vitest --config=src/js/vite.config.mjs --coverage",
- "testci": "vitest --config=src/js/vite.config.mjs --coverage --run",
- "postinstall": "patch-package --patch-dir=src/js/patches --error-on-fail && npx husky install",
- "patch": "patch-package --patch-dir=src/js/patches --error-on-fail",
- "prepare": "husky"
- },
- "engines": {
- "npm": ">=9.0.0 <11",
- "node": ">=20.0.0 <23"
- },
- "enginesComment": {
- "npm": "Npm arrived at version 9 in the middle of node 18 lifecycle, but version 9 is required to keep the version of package-lock.json at v3",
- "node": "We track supported vite node version, which is 18 as of vite 5"
- },
- "dependencies": {
- "single-spa-css": "^4.0.1",
- "single-spa-vue": "^3.0.1"
- },
- "depencenciesComment": {
- "single-spa-css": "https://github.com/single-spa/single-spa-css/releases",
- "single-spa-vue": "https://github.com/single-spa/single-spa-vue/releases"
- },
- "devDependencies": {
- "@commitlint/cli": "^19.8.1",
- "@commitlint/config-conventional": "^19.8.1",
- "@stylistic/eslint-plugin": "^5.0.0",
- "@testing-library/vue": "^8.1.0",
- "@vitejs/plugin-vue": "^6.0.0",
- "@vitest/coverage-istanbul": "^3.2.4",
- "check-engine": "^1.14.0",
- "concurrently": "^9.2.0",
- "copy-and-watch": "^0.1.8",
- "es-module-shims": "^2.6.1",
- "eslint": "^9.29.0",
- "eslint-config-prettier": "^10.1.5",
- "eslint-plugin-prettier": "^5.5.1",
- "eslint-plugin-vue": "^10.2.0",
- "happy-dom": "^20.0.0",
- "husky": "^9.1.7",
- "npm-run-all2": "^8.0.4",
- "patch-package": "^8.0.0",
- "prettier": "^3.6.1",
- "rollup-plugin-visualizer": "^6.0.3",
- "tinyglobby": "^0.2.14",
- "unplugin-auto-import": "^19.3.0",
- "unplugin-vue-components": "^28.7.0",
- "vite": "^7.0.0",
- "vite-plugin-static-copy": "^3.1.0",
- "vitest": "^3.2.4"
- },
- "devDepencenciesCommentWillAlsoBeAvailableAsDevDependenciesInWorkspace": {
- "@stylistic/eslint-plugin": "https://github.com/eslint-stylistic/eslint-stylistic/blob/main/CHANGELOG.md",
- "@vitejs/plugin-vue": "https://github.com/vitejs/vite-plugin-vue/blob/main/packages/plugin-vue/CHANGELOG.md",
- "es-module-shims": "https://github.com/guybedford/es-module-shims. Copied to be available as an external, but not in common-externals, because it will not be included from import-maps",
- "eslint": "",
- "eslint-config-prettier": "",
- "eslint-plugin-prettier": "",
- "eslint-plugin-vue": "",
- "happy-dom": "https://github.com/capricorn86/happy-dom/releases",
- "npm-run-all2": "Used to parallelize npm build operations. https://github.com/bcomnes/npm-run-all2/blob/master/CHANGELOG.md",
- "prettier": "",
- "sass": "https://github.com/sass/dart-sass/blob/main/CHANGELOG.md",
- "tinyglobby": "Only used directly in vite.config.mjs. Migrated from glob to align with vite and avoid problem with bad engine specifier in glob that skipped node 21. https://github.com/SuperchupuDev/tinyglobby/blob/main/CHANGELOG.md",
- "unplugin-auto-import": "https://github.com/unplugin/unplugin-auto-import/releases",
- "unplugin-vue-components": "https://github.com/unplugin/unplugin-vue-components/releases/tag/v28.7.0",
- "vite": "https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md",
- "vite-plugin-static-copy": "https://github.com/sapphi-red/vite-plugin-static-copy/blob/main/CHANGELOG.md",
- "vitest": "https://github.com/vitest-dev/vitest/releases"
- },
- "workspaces": [
+ "//" : [
+ "Note about updating package.json:",
+ "The behaviour of package-lock.json files upon running npm install has many subtleties, that are not especially obvious.",
+ "The short version is that when you update package.json, you have two general choices to get package-lock.json up to date.",
+ "1- Just run: ",
+ " npm install",
+ " It will update package-lock.json to meet the constraints, but not touch any installed package that already meets the constraints. So it's a minimal impact update",
+ "2- Run:",
+ " npm update",
+ " This will update ALL packages including transitive dependencies to the latest version that meet the semver in package.json.",
+ "To regenerate package-lock.json from scratch, run:",
+ " rm -r package-lock.json node_modules/;npm install",
+ "The above should have the same results as npm update, but that isn't always exactly the case."
+ ],
+ "name" : "tiki",
+ "version" : "0.0.1",
+ "type" : "module",
+ "scriptsComments" : {
+ "checkEnvironment:validNodeModules" : "The idea is to stop everything if a dev updated from git and forgot to run npm install. npm ls will do that (we check it's return code). Unfortunately it is verbose (no easy cross platform way to suppress the output and keep the return code) and takes almost as long to run as a npm install... Maybe just keep it until PHP developers get used to re-running composer and node - benoitg - 2023-11-24."
+ },
+ "scripts" : {
+ "checkEnvironment:engine" : "node src/js/build_utils/engineCheck.js",
+ "checkEnvironment:validNodeModules" : "npm ls",
+ "checkEnvironmentComment" : "The idea is to emulate running all processes sequentially with && (fail if any return a non zero exit code), but be compatible with the different shells on windows",
+ "checkEnvironment" : "run-s --print-label \"checkEnvironment:*\"",
+ "prebuild" : "run-s --print-label \"checkEnvironment\"",
+ "build:generateIconList" : "node lib/iconGeneratorNodeWrapper.js",
+ "build:js" : "vite --config=src/js/vite.config.mjs build --mode=production",
+ "build:scss" : "npm run build -w src/scss",
+ "build:_custom" : "copy-and-watch '_custom/**/themes/**/*.{woff,woff2,ttf,otf,svg,png,gif,jpg}' '_custom/**/{lang,js}/**/*.{js,mjs}' public/generated/_custom",
+ "build" : "concurrently --kill-others-on-fail \"npm:build:*\"",
+ "prewatch" : "npm run checkEnvironment",
+ "watch:generateIconList" : "npm run build:generateIconList",
+ "watch:js" : "vite --config=src/js/vite.config.mjs build --watch --mode=development",
+ "watch:scss" : "npm run watch -w src/scss",
+ "watch:_custom" : "copy-and-watch --watch '_custom/**/themes/**/*.{woff,woff2,ttf,otf,svg,png,gif,jpg}' '_custom/**/{lang,js}/**/*.{js,mjs}' public/generated/_custom",
+ "watch" : "concurrently --kill-others-on-fail \"npm:watch:*\"",
+ "lint" : "eslint --ext .js,.vue --ignore-path .gitignore --fix src",
+ "format" : "prettier . --write",
+ "clean:wsconf" : "php console.php dev:buildwsconfs --clean",
+ "clean:scss" : "npm run clean -w src/scss",
+ "clean" : "concurrently \"npm:clean:*\"",
+ "test" : "vitest --config=src/js/vite.config.mjs --coverage",
+ "testci" : "vitest --config=src/js/vite.config.mjs --coverage --run",
+ "postinstall" : "patch-package --patch-dir=src/js/patches --error-on-fail && npx husky install",
+ "patch" : "patch-package --patch-dir=src/js/patches --error-on-fail",
+ "prepare" : "husky"
+ },
+ "engines" : {
+ "npm" : ">=9.0.0 <11",
+ "node" : ">=20.0.0 <23"
+ },
+ "enginesComment" : {
+ "npm" : "Npm arrived at version 9 in the middle of node 18 lifecycle, but version 9 is required to keep the version of package-lock.json at v3",
+ "node" : "We track supported vite node version, which is 18 as of vite 5"
+ },
+ "dependencies" : {
+ "single-spa-css" : "^4.0.1",
+ "single-spa-vue" : "^3.0.1"
+ },
+ "depencenciesComment" : {
+ "single-spa-css" : "https://github.com/single-spa/single-spa-css/releases",
+ "single-spa-vue" : "https://github.com/single-spa/single-spa-vue/releases"
+ },
+ "devDependencies" : {
+ "@commitlint/cli" : "^19.8.1",
+ "@commitlint/config-conventional" : "^19.8.1",
+ "@stylistic/eslint-plugin" : "^5.0.0",
+ "@testing-library/vue" : "^8.1.0",
+ "@vitejs/plugin-vue" : "^6.0.0",
+ "@vitest/coverage-istanbul" : "^3.2.4",
+ "check-engine" : "^1.14.0",
+ "concurrently" : "^9.2.0",
+ "copy-and-watch" : "^0.1.8",
+ "es-module-shims" : "^2.6.1",
+ "eslint" : "^9.29.0",
+ "eslint-config-prettier" : "^10.1.5",
+ "eslint-plugin-prettier" : "^5.5.1",
+ "eslint-plugin-vue" : "^10.2.0",
+ "happy-dom" : "^20.0.0",
+ "husky" : "^9.1.7",
+ "npm-run-all2" : "^8.0.4",
+ "patch-package" : "^8.0.0",
+ "prettier" : "^3.6.1",
+ "rollup-plugin-visualizer" : "^6.0.3",
+ "tinyglobby" : "^0.2.14",
+ "unplugin-auto-import" : "^19.3.0",
+ "unplugin-vue-components" : "^28.7.0",
+ "vite" : "^7.0.0",
+ "vite-plugin-static-copy" : "^3.1.0",
+ "vitest" : "^3.2.4"
+ },
+ "devDepencenciesCommentWillAlsoBeAvailableAsDevDependenciesInWorkspace" : {
+ "@stylistic/eslint-plugin" : "https://github.com/eslint-stylistic/eslint-stylistic/blob/main/CHANGELOG.md",
+ "@vitejs/plugin-vue" : "https://github.com/vitejs/vite-plugin-vue/blob/main/packages/plugin-vue/CHANGELOG.md",
+ "es-module-shims" : "https://github.com/guybedford/es-module-shims. Copied to be available as an external, but not in common-externals, because it will not be included from import-maps",
+ "eslint" : "",
+ "eslint-config-prettier" : "",
+ "eslint-plugin-prettier" : "",
+ "eslint-plugin-vue" : "",
+ "happy-dom" : "https://github.com/capricorn86/happy-dom/releases",
+ "npm-run-all2" : "Used to parallelize npm build operations. https://github.com/bcomnes/npm-run-all2/blob/master/CHANGELOG.md",
+ "prettier" : "",
+ "sass" : "https://github.com/sass/dart-sass/blob/main/CHANGELOG.md",
+ "tinyglobby" : "Only used directly in vite.config.mjs. Migrated from glob to align with vite and avoid problem with bad engine specifier in glob that skipped node 21. https://github.com/SuperchupuDev/tinyglobby/blob/main/CHANGELOG.md",
+ "unplugin-auto-import" : "https://github.com/unplugin/unplugin-auto-import/releases",
+ "unplugin-vue-components" : "https://github.com/unplugin/unplugin-vue-components/releases/tag/v28.7.0",
+ "vite" : "https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md",
+ "vite-plugin-static-copy" : "https://github.com/sapphi-red/vite-plugin-static-copy/blob/main/CHANGELOG.md",
+ "vitest" : "https://github.com/vitest-dev/vitest/releases"
+ },
+ "overrides" : {
+ "dompurify" : "3.2.7"
+ },
+ "overridesComment" : {
+ "dompurify": [
+ "This override forces all packages to use DOMPurify v3.2.7 to fix a security vulnerability present in DOMPurify v2.x.",
+ "Upgrading from v2 to v3 is safe for our project because we do not support Internet Explorer (IE).",
+ "As noted by Victor Buzinaro in https://github.com/cure53/DOMPurify/issues/785, the only breaking change introduced in v3 is the removal of IE-specific support.",
+ "After reviewing the changes between versions 2.5.8 and 3.3.0 (https://github.com/cure53/DOMPurify/compare/2.5.8...3.3.0), we confirmed there are no functional breaking changes that affect our usage.",
+ "Toast UI Editor currently depends on DOMPurify v2.x, but its DOMPurify integration",
+ "(introduced in https://github.com/nhn/tui.editor/commit/6e5730914902071b54c529673e964a24b58e3eec#diff-e70b3ac7e7e963527907ae78c682a077c1b87015783bdcb150084e023ce17528) is compatible with v3.",
+ "For this reason, enforcing DOMPurify v3.2.7 is safe for us. We should remove this override once @toast-ui/editor officially updates to DOMPurify v3 or when we replace/fork it with a maintained version compatible with v3."
+ ]
+ },
+ "workspaces": [
"src/js/common-externals",
"src/js/common-reexported",
"src/js/jquery-tiki",
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/107413fc034e9556fe457b69cb4cef1a936d5f39
--
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/107413fc034e9556fe457b69cb4cef1a936d5f39
You're receiving this email because of your account on gitlab.com.
_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs