yoavain / fix-lockfile-integrity

Fix NPM lockfile integrity

👋 Hey there I'm Yoav - @yoavain

I am a full stack developer from Israel, working at SundaySky as a Senior Software Engineer.

My Expertise

Languages:

Platforms / Frameworks:

Tools:

IDE:

CI/CD:

DB:

Opensource contributions

• Creator of:
  create-windowless-app
  
  fix-lockfile-integrity
  

• Contributor for:
  node-notifier
  webpack-build-notifier
  npq
  lockfile-lint
  lockfix
  IntelliJ IDE Extra Icons plugin

Stats

Get in touch

fix-lockfile-integrity's Issues

Some sha1 packages skipped after failed fixes

In the following example, the sha1-package hash is not attempted to be fixed from the second registry due to the error from the first registry being cached for that sha1.

{
  "name": "my-package",
  "lockfileVersion": 1,
  "dependencies": {
    "sha1-package": {
      "version": "2.0.3",
      "resolved": "https://expired.domain.com/sha1-package/-/sha1-package-2.0.3.tgz",
      "integrity": "sha1-c"
    },
    "another-package": {
      "version": "5.2.0",
      "resolved": "https://registry.npmjs.org/another-package/-/another-package-5.2.0.tgz",
      "integrity": "sha512-b",
      "dependencies": {
        "sha1-package": {
          "version": "2.0.3",
          "resolved": "https://registry.npmjs.org/sha1-package/-/sha1-package-2.0.3.tgz",
          "integrity": "sha1-c"
        }
      }
    }
  }
}

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Rate-Limited

These updates are currently rate-limited. Click on a checkbox below to force their creation now.

• Update actions/setup-node action to v4.0.1
• Update dependency @types/jest to v29.5.11
• Update dependency eslint-plugin-import to v2.29.1
• Update dependency eslint-plugin-jest to v27.6.3
• Update dependency traverse to v0.6.8
• Update dependency ts-node to v10.9.2
• Update dependency @types/node to v20.11.4
• Update dependency eslint to v8.56.0
• Update dependency lint-staged to v15.2.0
• Update dependency eslint-plugin-security to v2
• Update dependency got to v14
• Update github/codeql-action action to v3
• 🔐 Create all rate-limited PRs at once 🔐

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update dependency cosmiconfig to v8.3.6
• Update dependency typescript to v5.3.3
• Update dependency cosmiconfig to v9
• Update dependency cosmiconfig-typescript-loader to v5
• Update dependency p-limit to v5
• Click on this checkbox to rebase all open PRs at once

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

• Update dependency chalk to v5
• Update dependency prettier to v3
• Update npm to v10
• Update typescript-eslint monorepo to v6 (major) (@typescript-eslint/eslint-plugin, @typescript-eslint/parser)

Detected dependencies

github-actions

.github/workflows/codeql-analysis.yml

• actions/checkout v4
• github/codeql-action v2
• github/codeql-action v2
• github/codeql-action v2

.github/workflows/new-dependencies-advisor.yml

• actions/checkout v4.1.1
• lirantal/github-action-new-dependencies-advisor v1.2.0

.github/workflows/nodejs.yml

• actions/checkout v4.1.1
• actions/setup-node v4.0.0
• codecov/codecov-action v3.1.4
• actions/checkout v4.1.1
• actions/setup-node v4.0.0
• softprops/action-gh-release v1

npm

package.json

• chalk 4.1.2
• cosmiconfig 8.1.3
• cosmiconfig-typescript-loader 4.4.0
• got 11.8.6
• p-limit 3.1.0
• prettier 2.8.8
• traverse 0.6.7
• ts-node 10.9.1
• yargs 17.7.2
• @tsconfig/node18 18.2.2
• @types/jest 29.5.10
• @types/node 20.10.0
• @typescript-eslint/eslint-plugin 5.62.0
• @typescript-eslint/parser 5.62.0
• add-shebang 0.1.0
• cross-env 7.0.3
• del 7.1.0
• eslint 8.54.0
• eslint-plugin-import 2.29.0
• eslint-plugin-jest 27.6.0
• eslint-plugin-node 11.1.0
• eslint-plugin-security 1.7.1
• global-npm 0.5.0
• husky 8.0.3
• jest 29.7.0
• lint-staged 15.1.0
• rimraf 5.0.5
• ts-jest 29.1.1
• typescript 5.2.2
• node >=14 <21
• npm <=9

---

• Check this box to trigger a request for Renovate to run again on this repository

Add suggested configuration for a Lerna monorepo project (generic)

Add a configuration example that does not require modification on each new package

Should suggest in documentation using `postshrinkwrap` script for NodeJS 14.x