feat: verify package-lock.json UTD (up to date) & audited

[mfranzke]

Proposed changes

From time to time we experience out of date package-lock.json files. To prevent that those are resulting out of our local development (as they are unlikely based on dependabot updates), we should enforce that those are quickly checked in git push lifecycle phase.
Additionally running npm audit fix would ensure that some of the easy dependency fixes would get adapted directly.

Types of changes

• Bugfix (non-breaking change that fixes an issue)
• New feature (non-breaking change which adds functionality)
• Refactoring (improvements to existing components or architectural decisions)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation Update (if none of the other choices apply)

Further comments

[nmerget]

I think this isn't a good solution.

The package you used just uses npm install --package-lock-only --ignore-scripts to compare the file contents. If we switch to pnpm this package wouldn't work.

Anyways I don't see the problem with npm ci. The first step in our pipeline would fail if the package-lock.json is out of date. This happens sometimes, but most of the time you have to install the dependency to use it in you branch.

Instead of adding this we should consider solving #3372 and move to pnpm. A lot of current problems would be solved with pnpm

[mfranzke]

I think this isn't a good solution.

The package you used just uses npm install --package-lock-only --ignore-scripts to compare the file contents. If we switch to pnpm this package wouldn't work.

Anyways I don't see the problem with npm ci. The first step in our pipeline would fail if the package-lock.json is out of date. This happens sometimes, but most of the time you have to install the dependency to use it in you branch.

Instead of adding this we should consider solving #3372 and move to pnpm. A lot of current problems would be solved with pnpm

I agree with the idea of removing the package, but I also like the idea of an additional check before pushing. We had some more npm ci failures in our pipelines, which could have been prevented by a conditional QA test on our local hosts. It doesn't hurt anyone.

[Copilot]

Pull Request Overview

This PR adds verification to ensure package-lock.json files are up-to-date before pushing changes to prevent out-of-date lock files from being committed. The implementation adds both pre-push and pre-commit hooks to detect and handle package manager file changes.

• Adds a pre-push hook that detects changes to package manager files and automatically runs install commands to verify lock files are current
• Adds a lint-staged rule to run npm audit fix on package-lock.json changes during pre-commit
• Supports both npm and pnpm package managers with automatic detection based on lock file presence

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
.husky/pre-push	New pre-push hook script that detects package manager files and runs install commands to verify lock files are up-to-date
.config/.lintstagedrc.js	Adds npm audit fix rule for package-lock.json files during pre-commit