refactor: Convert shrinkwrap extractor tool to package-lock - #1551
Open
d3xter666 wants to merge 2 commits into
Open
refactor: Convert shrinkwrap extractor tool to package-lock#1551d3xter666 wants to merge 2 commits into
d3xter666 wants to merge 2 commits into
Conversation
d3xter666
marked this pull request as draft
August 27, 2026 14:59
d3xter666
force-pushed
the
refactor/shrinkwrap-to-lockfile-convertion
branch
2 times, most recently
from
August 27, 2026 15:21
bb2e873 to
ab9b808
Compare
d3xter666
force-pushed
the
refactor/shrinkwrap-to-lockfile-convertion
branch
from
August 27, 2026 15:30
ab9b808 to
96c7db8
Compare
d3xter666
commented
Aug 28, 2026
| @@ -0,0 +1,340 @@ | |||
| import {readFile, mkdtemp, writeFile, rm} from "node:fs/promises"; | |||
Member
Author
There was a problem hiding this comment.
This file is actually renamed internal/shrinkwrap-extractor/lib/convertPackageLockToShrinkwrap.js. I don't know why GitHub splits them this way
Migrates from the deprecated npm-shrinkwrap.json (npm/cli#9262) to bundleDependencies: true. The lockfile-extractor now generates a standalone package-lock.json; the package is then copied outside the workspace, installed via npm ci, and packed via npm pack to bundle all production node_modules.
d3xter666
force-pushed
the
refactor/shrinkwrap-to-lockfile-convertion
branch
from
August 28, 2026 09:09
96c7db8 to
3ca822d
Compare
d3xter666
marked this pull request as ready for review
August 28, 2026 11:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
JIRA: CPOUI5FOUNDATION-1283
Shrinkwrap is being deprecated (npm/cli#9262) in node, but we want to keep and guard the dependencies that we ship with the
UI5 CLI.We have decided to go with NPM's packge.json
bundeDependenciespropertybundleDependencieshas its own issues when working with monorepos. The core issue is that it simply bundles anything that's within that package'snode_modules/folder and does not consider any hoisted packages that monorepos naturally have.With this context in mind, we have decided to leverage our internal tool
shrinkwrap-extractorand adjust it to fit for thebundleDependenciescase.Here's the expected workflow:
shrinkwrap-extractorto something more meaningful in the new context. Proposal:lockfile-extractorlockfile-extractorforpackages/cli. This will result inpackage-lock.jsonfile extraction suitable just for the@ui5/clipackage.packages/cliout of the scope of the monorepo by copying its files in a $TEMP dir.devDependencies) frompackage.jsonnpm ci, so that dependencies are installed with the exact same versions that are defined within the generated earlierpackage-lock.jsonnpm packandnpm publish, so that the generated tarball taht includes also thebundledependenciesgets published on NPMNote: This PR simply renames the shrinkwrap-extractor to lockfile-extractor. The only real change is the handling of publish GH Action: https://github.com/UI5/cli/pull/1551/changes#diff-2c84033033d49186c63e6adcd705f63b11ae6814cd76c152c9c486d389fbccf3