feat: verify package-lock.json is UTD (up to date) & audited
#4598
+81
−1
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This reverts commit eeeea2d.
This reverts commit cd63f49.
This reverts commit 52c9f51.
This reverts commit ae9a456.
This reverts commit 3e6295f.
This reverts commit 024e42e.
This reverts commit a8fd3d4.
This reverts commit b990c9f.
This reverts commit 8d59270.
This reverts commit 21dfc4e.
This reverts commit c8e1a6a.
This reverts commit 921422d.
mfranzke
moved this from 👀 In review
to 🏗 In development
in UX Engineering Team Backlog
auto-merge was automatically disabled
July 28, 2025 04:49
Pull request was converted to draft
There was a problem hiding this comment.
Pull Request Overview
This PR adds verification to ensure package-lock.json files are up-to-date before pushing changes to prevent out-of-date lock files from being committed. The implementation adds both pre-push and pre-commit hooks to detect and handle package manager file changes.
- Adds a pre-push hook that detects changes to package manager files and automatically runs install commands to verify lock files are current
- Adds a lint-staged rule to run
npm audit fixon package-lock.json changes during pre-commit - Supports both npm and pnpm package managers with automatic detection based on lock file presence
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| .husky/pre-push | New pre-push hook script that detects package manager files and runs install commands to verify lock files are up-to-date |
| .config/.lintstagedrc.js | Adds npm audit fix rule for package-lock.json files during pre-commit |
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
mfranzke
changed the title
package-lock.json UTD (up to date)package-lock.json UTD (up to date) & audited
mfranzke
changed the title
package-lock.json UTD (up to date) & auditedpackage-lock.json is UTD (up to date) & audited
mfranzke
commented
Aug 13, 2025
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
michaelmkraus
approved these changes
Aug 14, 2025
github-project-automation
bot
moved this from 👀 In review
to ✅ Done
in UX Engineering Team Backlog
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed changes
From time to time we experience out of date
package-lock.jsonfiles. To prevent that those are resulting out of our local development (as they are unlikely based on dependabot updates), we should enforce that those are quickly checked ingit pushlifecycle phase.Additionally running
npm audit fixwould ensure that some of the easy dependency fixes would get adapted directly.Types of changes
Further comments