Added package-lock.json, made gui build reproducible#1017
Conversation
|
changed PR's base branch |
|
I didn't add package-json.lock to the repository, as it will be generated automatically. Question is also, if we add a *.lock file, do we have to update the dependencies manually then? Or wouldn't it be easier, if it will be created automatically. |
as per npm documentation: the .lock file is needed if you want to have reproducible builds as it stores the precise version of all dependencies (and some downstream package systems requires it for this exact reason), so as to eliminate possible inconsistencies due to an inadvertently updated dependencies, and it allows to build old FreeDATA versions with the same old npm dependencies resulting in the same exact build. When you want to update the dependencies you just run (PS. I've updated the lockfile to respect the last develop commits) |
|
Okay, thanks for the clarification! Then I would say, it's time for a merge? Anything else you want to add? |
on my end there is nothing else to do on this side 👍🏻 |
Only node libraries can avoid having a package-lock.json. For applications it is required for better reproducibility.
See the official documentation: https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json#description