chore(deps): lock file maintenance

[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: "before 5am on monday" (UTC).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Renovate will not automatically rebase this PR, because other commits have been found.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box.

---

This PR has been generated by WhiteSource Renovate. View repository job log here.

[github-actions]

⏱ Benchmark results

largeDepsEsbuild: 13.2s

^  13.2s  
│   ┌──┐  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
└───┴──┴──>
     T    

Legend

• T (current commit): 13.2s

largeDepsZisi: 1m 7.5s

^ 1m 7.5s 
│   ┌──┐  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
│   |▒▒|  
└───┴──┴──>
     T    

Legend

• T (current commit): 1m 7.5s

[netlify-team-account-1]

@eduardoboucas is it intentional that renovate updates benchmark/fixtures/package-lock.json? Seems like a file that should stay the same 🤔

(not the root cause for CI failing, though)

[eduardoboucas]

Seems like a file that should stay the same 🤔

I agree. We should probably ignore it here. If you have the chance to address that as part of this, that would be great!

[netlify-team-account-1]

Our package-lock.json uses lockfileVersion: 2, which is only compatible with newer NPM versions. Since newer Node distributions ship a recent NPM version, it's fine for the * target. Node 10.18.0 shipped NPM 6, though, which doesn't fully understand lockfileVersion: 2 and thus fails to require typescript, which was added as a transitive dependency trough this lockfile update. d2c2011 fixes the CI by always using npm@7, even for Node 10.18.0.

[eduardoboucas]

Our package-lock.json uses lockfileVersion: 2, which is only compatible with newer NPM versions. Since newer Node distributions ship a recent NPM version, it's fine for the * target. Node 10.18.0 shipped NPM 6, though, which doesn't fully understand lockfileVersion: 2 and thus fails to require typescript, which was added as a transitive dependency trough this lockfile update. d2c2011 fixes the CI by always using npm@7, even for Node 10.18.0.

V2 lockfiles are backwards compatible with older npm versions, including npm 6, so why does it fail to require typescript? People using Node 10 will most likely use npm 6, as that's the version that it ships with, so we need to support that flow, otherwise we can't really say the package is compatible with Node 10.

This is the case with our build system when using Xenial, by the way, which uses Node 10 and npm 6 by default.

[netlify-team-account-1]

V2 lockfiles are backwards compatible with older npm versions, including npm 6

Apparently not fully backwards compatible 😅

we need to support that flow

Got it! I'm pretty sure that this failure only concerns our test suite, as the problematic typescript import comes from somewhere inside an eslint package. So it shouldn't become a problem in production - but we should try to keep our test environment as close as possible. So I'll try to find a solution that keeps npm@6.

[netlify-team-account-1]

Interesting! The more I look into this, the more problems with Node v10 arise 😅 @netlify/eslint-config-node has a dependency on eslint-plugin-unicorn, which dropped support for Node v10 in v32. unicorn has since introduced calls to Object.fromEntries, which isn't available under Node v10, and thus makes the CI fail with TypeError: Failed to load plugin 'unicorn' declared in '.eslintrc.js » @netlify/eslint-config-node': Object.fromEntries is not a function.
I'm surprised that this only surfaces with this PR 🤔

[erezrokah]

I'm surprised that this only surfaces with this PR

FYI, we skip linting for Node.js 10

zip-it-and-ship-it/.github/workflows/workflow.yml

Line 36 in 1efb897

if: "${{ matrix.node-version == '*' }}"

[netlify-team-account-1]

okay, so that's why it only surfaces with this PR ^^ Thanks for pointing that out! :)

[netlify-team-account-1]

I did quite some digging to find out why it requires typescript to be installed, but couldn't find a sensible reason.
And since we're already planning on introducing typescript via #675, I think it's fine to just ignore the reasons for why this is failing, and give it what it wants. It wants typescript.

[netlify-team-account-1]

@eduardoboucas I think this is ready to merge, could you do a final review?

[eduardoboucas]

I did quite some digging to find out why it requires typescript to be installed, but couldn't find a sensible reason. And since we're already planning on introducing typescript via #675, I think it's fine to just ignore the reasons for why this is failing, and give it what it wants. It wants typescript.

After db3f8d9, we're adding typescript to dependencies, whereas #675 only needs it in devDependencies. We should probably create an issue to reevaluate whether we still need it in dependencies after we get rid of precinct. What do you think?

[netlify-team-account-1]

typescript is currently a transitive prod dependency of precinct, so there's no need for it once we get rid of precinct. We can open an issue to get rid of precinct, and mention this PR in there.

[eduardoboucas]

typescript is currently a transitive prod dependency of precinct, so there's no need for it once we get rid of precinct.

That's what I mean. And there's no reason to open an issue to get rid of precinct, because that's already in motion (see #659). We just need to roll it out fully (it's behind a feature flag).

[kodiakhq]

This PR currently has a merge conflict. Please resolve this and then re-add the automerge label.

[eduardoboucas]

This PR currently has a merge conflict. Please resolve this and then re-add the automerge label.

Where did this come from? 🤨 I've only merged #695, which doesn't touch the lock file.

[netlify-team-account-1]

I merged some of the other renovate PRs, maybe that's why.