{"action":"created","issue":{"url":"https://api.github.com/repos/Automattic/wp-calypso/issues/23348","repository_url":"https://api.github.com/repos/Automattic/wp-calypso","labels_url":"https://api.github.com/repos/Automattic/wp-calypso/issues/23348/labels{/name}","comments_url":"https://api.github.com/repos/Automattic/wp-calypso/issues/23348/comments","events_url":"https://api.github.com/repos/Automattic/wp-calypso/issues/23348/events","html_url":"https://github.com/Automattic/wp-calypso/issues/23348","id":305728212,"number":23348,"title":"Framework: Avoid churn in npm-shrinkwrap.json","user":{"login":"nylen","id":227022,"avatar_url":"https://avatars2.githubusercontent.com/u/227022?v=4","gravatar_id":"","url":"https://api.github.com/users/nylen","html_url":"https://github.com/nylen","followers_url":"https://api.github.com/users/nylen/followers","following_url":"https://api.github.com/users/nylen/following{/other_user}","gists_url":"https://api.github.com/users/nylen/gists{/gist_id}","starred_url":"https://api.github.com/users/nylen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nylen/subscriptions","organizations_url":"https://api.github.com/users/nylen/orgs","repos_url":"https://api.github.com/users/nylen/repos","events_url":"https://api.github.com/users/nylen/events{/privacy}","received_events_url":"https://api.github.com/users/nylen/received_events","type":"User","site_admin":false},"labels":[{"id":285010074,"url":"https://api.github.com/repos/Automattic/wp-calypso/labels/Build","name":"Build","color":"bfdadc","default":false},{"id":285009988,"url":"https://api.github.com/repos/Automattic/wp-calypso/labels/Framework","name":"Framework","color":"c5def5","default":false},{"id":285009976,"url":"https://api.github.com/repos/Automattic/wp-calypso/labels/[Type]%20Enhancement","name":"[Type] Enhancement","color":"c7def8","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-03-15T21:37:11Z","updated_at":"2018-03-16T19:04:35Z","closed_at":null,"author_association":"MEMBER","body":"Our `npm-shrinkwrap.json` which lists the exact versions of all of our dependencies has gotten a bit crazy.  Here is a history of commits that changed this file with the number of lines added/removed in each commit:\r\n\r\n```\r\n$ git log --oneline npm-shrinkwrap.json | cut -d' ' -f1 | while read i; do git show --text \"$i\" npm-shrinkwrap.json | grep -Po '^[+-]' | sort | uniq -c | tr -d '\\n'; echo -n '    '; git log --oneline \"$i\" -n 1 | cat; done | pbcopy\r\n    808 -     17 +    de96853 Bump to Gridicons 3.0.1 (#23306)\r\n      3 -    794 +    4901875 package.json: Bump `notifications-panel` to v2.1.8 (#23278)\r\n      9 -      9 +    52b3577 Revert \"Update to gridicons 3 (#23171)\" (#23304)\r\n    801 -     22 +    113841d Update to gridicons 3 (#23171)\r\n    167 -    377 +    0a930af Framework: Use qs module instead of querystring (#23265)\r\n     25 -     24 +    0fceb6d package.json: Bump `notifications-panel` to v2.1.6. (#23182)\r\n     76 -     90 +    a5ea162 PR Tweak: Less hacky approach with an extended DelayRender component\r\n    249 -    255 +    28febda Upgrade moment library to 2.21.0 (#23023)\r\n      8 -    176 +    a560773 Webpack: strictly verify imports and disable nodejs polyfilling (#22630)\r\n    123 -   1274 +    6eb73cd Dependencies: Bump wpcom.js and slightly improve webpack config (#22854)\r\n     95 -     84 +    366ad7b Framework: Update Gridicons to v.2.1.3 (#22732)\r\n    202 -     22 +    de953d7 Framework: eliminate pug (#22348)\r\n    100 -    894 +    eb1ed86 Remove dependency on the 'numeral' NPM package\r\n   1094 -    309 +    74ed256 Fix the \"analyze-bundles\" and \"build-client\" commands in Windows\r\n... and many many more\r\n```\r\n\r\nYou can see that there is a lot of churn in this file recently.  Some of it is related to intentional dependency changes, but there are also these changes of about 800 lines that flip back and forth fairly consistently.\r\n\r\nOn my computer, depending on how I update the lock file in `master`, I can get one of several different results:\r\n\r\n```\r\n    738 -    118 +    093f7c7 Update shrinkwrap again (with --no-optional flag)\r\n    114 -    734 +    24b4a25 Update shrinkwrap using `npm run update-deps`\r\n     10 -     10 +    e23c7cf Update shrinkwrap using `npm run update-deps` (3rd time's the charm!)\r\n```\r\n\r\nThis file changes dramatically depending on who updates it, apparently depending on the OS and configuration they are using to develop Calypso.  For example: the optional dependency `fsevents` is only installed on OS X, so my computer doesn't install it.  Some history on this issue:  https://github.com/Automattic/wp-calypso/pull/12370#issuecomment-298791026, https://github.com/Automattic/wp-calypso/pull/18767#issuecomment-336281221\r\n\r\nBut ideally, we just want a package lock file that **ensures reliable builds** in Docker and on the Calypso servers, so it shouldn't change across different kinds of machines or configurations.  We also shouldn't be committing a lot of these spurious diffs to git.\r\n\r\nI'm not sure the best way to fix or improve this, but seeing big `npm-shrinkwrap.json` diffs in PRs makes me a bit nervous."},"comment":{"url":"https://api.github.com/repos/Automattic/wp-calypso/issues/comments/373814589","html_url":"https://github.com/Automattic/wp-calypso/issues/23348#issuecomment-373814589","issue_url":"https://api.github.com/repos/Automattic/wp-calypso/issues/23348","id":373814589,"user":{"login":"blowery","id":14350,"avatar_url":"https://avatars1.githubusercontent.com/u/14350?v=4","gravatar_id":"","url":"https://api.github.com/users/blowery","html_url":"https://github.com/blowery","followers_url":"https://api.github.com/users/blowery/followers","following_url":"https://api.github.com/users/blowery/following{/other_user}","gists_url":"https://api.github.com/users/blowery/gists{/gist_id}","starred_url":"https://api.github.com/users/blowery/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blowery/subscriptions","organizations_url":"https://api.github.com/users/blowery/orgs","repos_url":"https://api.github.com/users/blowery/repos","events_url":"https://api.github.com/users/blowery/events{/privacy}","received_events_url":"https://api.github.com/users/blowery/received_events","type":"User","site_admin":false},"created_at":"2018-03-16T19:04:35Z","updated_at":"2018-03-16T19:04:35Z","author_association":"CONTRIBUTOR","body":"@samouri my between-the-lines read of that is that we also have to move to a `package-lock.json`, off of shrinkwrap?"}}
{"actor":{"display_login":"blowery"}}