NXT-17571: Support npm lockfileVersion 2 and 3 in bootstrap --override#395
Open
bongsok wants to merge 5 commits into
Open
NXT-17571: Support npm lockfileVersion 2 and 3 in bootstrap --override#395bongsok wants to merge 5 commits into
bongsok wants to merge 5 commits into
Conversation
Co-Authored-By: Claude <noreply@anthropic.com>
Set `version` and `resolved` to the local file dependency and remove `from`, `integrity`, and `requires`, matching the legacy `dependencies` tree logic.
bongsok
force-pushed
the
NXT-17571-bootstrap-lockfile-v3
branch
from
July 20, 2026 06:19
a5a45f1 to
7727513
Compare
A dependency can be installed at the top level or nested under another package (e.g. node_modules/@enact/limestone/node_modules/@enact/core), so rewrite every packages entry whose path resolves to the overridden package instead of only the top-level one. Also drop `resolved` alongside the other stale fields to mirror the lockfileVersion 1 handling.
| Object.keys(obj.packages) | ||
| .filter(key => key === suffix || key.endsWith('/' + suffix)) | ||
| .forEach(key => { | ||
| obj.packages[key].version = fileDep; |
Contributor
There was a problem hiding this comment.
In the "packages" map the file path lives in "resolved"
Suggested change
| obj.packages[key].version = fileDep; | |
| obj.packages[key].resolved= fileDep; |
| .forEach(key => { | ||
| obj.packages[key].version = fileDep; | ||
| // Remove unneeded properties to avoid issues | ||
| ['resolved', 'from', 'integrity', 'requires'].forEach( |
Contributor
There was a problem hiding this comment.
Suggested change
| ['resolved', 'from', 'integrity', 'requires'].forEach( | |
| ['from', 'integrity', 'requires'].forEach( |
| ); | ||
| } else { | ||
| local.forEach(dep => { | ||
| const fileDep = 'file:' + path.join(override, dep, 'package.tgz'); |
Contributor
There was a problem hiding this comment.
fileDep is built with path.join(...), which emits \ on Windows, producing file:..\override....
npm can't resolve that (npm error enoent). Normalizing separators would fix the problem. please check
Suggested change
| const fileDep = 'file:' + path.join(override, dep, 'package.tgz'); | |
| const fileDep = 'file:' + path.join(override, dep, 'package.tgz').split(path.sep).join('/'); |
For the packages map (lockfileVersion 2 & 3), set `resolved` to the local file dependency and drop `version` (npm derives it from the tarball), matching how npm records local file installs. Also normalize the file dependency path to POSIX separators so generated lockfiles are consistent on Windows.
Instead of rewriting nested packages entries (node_modules/@enact/limestone/node_modules/@enact/core), remove them so the dependent package resolves to the overridden top-level package (node_modules/@enact/core). Only the top-level entry is repointed at the local tgz via `resolved`, keeping its `version`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Checklist
Issue Resolved / Feature Added
Fixes
enact bootstrap --overridenot supporting npmpackage-lock.jsonwithlockfileVersion2 or 3.The existing override logic only rewrites the top-level
dependenciestree used by lockfileVersion 1. lockfileVersion 2 keeps that tree for backwards compatibility, but lockfileVersion 3 drops thedependenciestree and uses only thepackagesmap. As a result, on a v3 lockfile the override silently found nothing to rewrite and no-oped.Resolution
Added
packagesmap handling to the override lockfile-rewriting logic incommands/bootstrap.js.packagesmap (v2 & v3): sets eachnode_modules/<dep>entry'sresolvedto the localfile:...tgzpath and removesfrom/integrity. Also updates the root package ("")dependencies/devDependencies/optionalDependenciesspecifiers.dependenciestree (v1, and the legacy tree kept in v2): behavior preserved for backwards compatibility.lockfileVersion/requiresmetadata assignment out of the dep loop so it is set correctly even when no dependency matches.i > 0) to a filename check (path.basename(f) !== 'package.json') to avoid a misidentification whenpackage.jsonis absent.Additional Considerations
Should be verified against projects whose
package-lock.jsonuses lockfileVersion 1, 2, and 3 respectively, to confirm--overridecorrectly swaps in the local tgz dependencies in each case.Links
NXT-17571
Comments