Giter VIP home page Giter VIP logo

lockfix's Introduction

#StandWithUkraine

  _               _    _____ _      
 | |    ___   ___| | _|  ___(_)_  __
 | |   / _ \ / __| |/ / |_  | \ \/ /
 | |__| (_) | (__|   <|  _| | |>  < 
 |_____\___/ \___|_|\_\_|   |_/_/\_\

lockfix

Snyk Vulnerabilities badge Maintainability Language grade: JavaScript

NPM badge

⭐️ Please, star me on GitHub — it helps!

lockfix – is a git based CLI tool, which helps to revert sha1 integrity changes of npm lock file

Before screenshot before

After screenshot after

🧬 Table of Contents

❓ Why? 🔝

NPM has known issue of constantly changing integrity property of its lock file. Integrity may change due to plenty of reasons. Some of them are:

  • npm install done on machine with different OS from one where lock file generated
  • some package version updated
  • another version of npm used

Intention of this tool is to prevent such changes and make integrity property secure and reliable.

✨ Features 🔝

  • Reverts changes from sha512 to sha1. Keeps untouched changes from sha1 to sha512. sha512 algorithm is more secure.
  • Works well with both package-lock.json and npm-shrinkwrap.json
  • Possibility to revert any changes done by this tool

💾 Install 🔝

Install per project with NPM

npm install --save-dev lockfix

or to install globally

npm install -g lockfix

🔨 Usage 🔝

Add to package.json

"scripts": {
    "postshrinkwrap": "lockfix",
},

Manually from terminal

lockfix

or (without install)

npx lockfix

Options

Usage: lockfix [options]

Options:
  -V, --version  output the version number
  -c, --commit   make backup commit with revert instruction before applying changes
  -f, --force    bypass Git root directory check
  -q, --quiet    suppress output
  -h, --help     display help for command

📄 License 🔝

This software licensed under the MIT

lockfix's People

Contributors

imgbotapp avatar kopach avatar nacitar avatar renovate-bot avatar renovate[bot] avatar yoavain avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar

lockfix's Issues

Skip hooks while git commit

Some git hooks like prepare-commit-msg may require user interaction. That process will block tool from doing commit.

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Warning

These dependencies are deprecated:

Datasource Name Replacement PR?
npm shortid Unavailable
npm tslint Unavailable
npm tslint-config-standard Unavailable

Rate-Limited

These updates are currently rate-limited. Click on a checkbox below to force their creation now.

  • chore(deps): update dependency rimraf to v6
  • fix(deps): update dependency commander to v12
  • fix(deps): update dependency execa to v9
  • 🔐 Create all rate-limited PRs at once 🔐

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

Detected dependencies

npm
package.json
  • chalk 4.1.2
  • commander 6.2.1
  • execa 4.1.0
  • shelljs 0.8.5
  • shortid 2.2.16
  • @types/node 14.18.54
  • @types/shelljs 0.8.12
  • @types/shortid 0.0.29
  • adr 1.4.5
  • lockfix 2.2.1
  • np 7.7.0
  • prettier 2.8.8
  • prettier-package-json 2.8.0
  • rimraf 3.0.2
  • ts-node 10.9.1
  • tslint 6.1.3
  • tslint-clean-code 0.2.10
  • tslint-config-airbnb 5.11.2
  • tslint-config-prettier 1.18.0
  • tslint-config-standard 9.0.0
  • tslint-no-circular-imports 0.7.0
  • tslint-plugin-prettier 2.3.0
  • typescript 4.9.5
travis
.travis.yml
  • node 11
  • node 12
  • node 13

  • Check this box to trigger a request for Renovate to run again on this repository

Unable to Detect .git Root on Window Operating System

When you attempt to run npm run postshrinkwrap on Window's computers, you'll see the Not a Git root directory, exiting... message; things work as expected on Mac OS.

Looking at the code, I believe the issue is here. Before this check, should the \ or / be removed or replaced to handle the differences between operating systems?

Action Required: Fix Renovate Configuration

There is an error with this repository's Renovate configuration that needs to be fixed. As a precaution, Renovate will stop PRs until it is resolved.

Error type: undefined. Note: this is a nested preset so please contact the preset author if you are unable to fix it yourself.

lockfix reverts changes if cannot apply the patch

My repository has multiple projects, some of them are C#, others are nodejs.
The structure is like this:

solution
  some-nodejs-proj
  some-c#-proj
    another-nodejs-proj
...

when some-c#-proj has some changes (C# files, changed and added files), and in another-nodejs-proj I run lockfix -f, it reverts my changes.
I repeated the steps from the lockfix.ts, and figured out that the patch created by git diff --binary HEAD cannot be applied to my working copy, most likely because of UTF BOM in the affected hunks.
however, the tool doesn't report any error about the error for the patch apply, and (which is worse) it doesn't preserve the working copy state.

I would suggest the following improvements to the tool:

  1. don't touch the files other than package-lock.json. It will minimize the potential damage.
  2. make a copy of the files being modified, so they can be restored in case of failure (automatically or manually).

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.