{"action":"created","issue":{"url":"https://api.github.com/repos/trufflesuite/truffle/issues/2555","repository_url":"https://api.github.com/repos/trufflesuite/truffle","labels_url":"https://api.github.com/repos/trufflesuite/truffle/issues/2555/labels{/name}","comments_url":"https://api.github.com/repos/trufflesuite/truffle/issues/2555/comments","events_url":"https://api.github.com/repos/trufflesuite/truffle/issues/2555/events","html_url":"https://github.com/trufflesuite/truffle/issues/2555","id":517563311,"node_id":"MDU6SXNzdWU1MTc1NjMzMTE=","number":2555,"title":"NPM packages don't have pinned versions.","user":{"login":"MicahZoltu","id":886059,"node_id":"MDQ6VXNlcjg4NjA1OQ==","avatar_url":"https://avatars2.githubusercontent.com/u/886059?v=4","gravatar_id":"","url":"https://api.github.com/users/MicahZoltu","html_url":"https://github.com/MicahZoltu","followers_url":"https://api.github.com/users/MicahZoltu/followers","following_url":"https://api.github.com/users/MicahZoltu/following{/other_user}","gists_url":"https://api.github.com/users/MicahZoltu/gists{/gist_id}","starred_url":"https://api.github.com/users/MicahZoltu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MicahZoltu/subscriptions","organizations_url":"https://api.github.com/users/MicahZoltu/orgs","repos_url":"https://api.github.com/users/MicahZoltu/repos","events_url":"https://api.github.com/users/MicahZoltu/events{/privacy}","received_events_url":"https://api.github.com/users/MicahZoltu/received_events","type":"User","site_admin":false},"labels":[{"id":644098328,"node_id":"MDU6TGFiZWw2NDQwOTgzMjg=","url":"https://api.github.com/repos/trufflesuite/truffle/labels/needs%20reproduced","name":"needs reproduced","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2019-11-05T05:58:54Z","updated_at":"2019-11-07T00:01:42Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"- [X] I've asked for help in the [Truffle Gitter](http://gitter.im/Consensys/truffle) before filing this issue.\r\n\r\n---------------------------\r\n\r\n## Issue\r\n`npm install @truffle/workflow-compile` will result in getting different transitive dependencies depending on what is available from NPM at install time.  While this is a specific problem that can be addressed, the bigger issue is that none of the distributed NPM packages appear to include a `package-lock.json` which I believe is required by NPM in order to fetch fixed versions.  Without it, dependency versions from `package.json` will be used and any transitive dependencies will follow whatever versioning strategy they have internally.\r\n\r\n## Steps to Reproduce\r\n1. Create new project.\r\n1. `npm install @truffle/workflow-compile`\r\n1. Commit (including `package-lock.json`) and push to GitHub.\r\n1. Wait for automated security check in the background.\r\n1. Receive email notifying you of security issues with packages.\r\n\r\n## Expected Behavior\r\nAll Truffle packages published to NPM include a `package-lock.json` file that includes a fixed set of dependencies (including transitives).\r\n\r\n## Actual Results\r\nAll Truffle packages appear to be published to NPM without a `package-lock.json` file, which means dependency versions are calculated an user install time.\r\n\r\n## Environment\r\n\r\n* Operating System: Windows 10\r\n* Ethereum client: N/A\r\n* Truffle version (`truffle version`): 5.0.43\r\n* node version (`node --version`): 12.3.0\r\n* npm version (`npm --version`): 6.9.0\r\n"},"comment":{"url":"https://api.github.com/repos/trufflesuite/truffle/issues/comments/550556974","html_url":"https://github.com/trufflesuite/truffle/issues/2555#issuecomment-550556974","issue_url":"https://api.github.com/repos/trufflesuite/truffle/issues/2555","id":550556974,"node_id":"MDEyOklzc3VlQ29tbWVudDU1MDU1Njk3NA==","user":{"login":"davidmurdoch","id":187813,"node_id":"MDQ6VXNlcjE4NzgxMw==","avatar_url":"https://avatars2.githubusercontent.com/u/187813?v=4","gravatar_id":"","url":"https://api.github.com/users/davidmurdoch","html_url":"https://github.com/davidmurdoch","followers_url":"https://api.github.com/users/davidmurdoch/followers","following_url":"https://api.github.com/users/davidmurdoch/following{/other_user}","gists_url":"https://api.github.com/users/davidmurdoch/gists{/gist_id}","starred_url":"https://api.github.com/users/davidmurdoch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidmurdoch/subscriptions","organizations_url":"https://api.github.com/users/davidmurdoch/orgs","repos_url":"https://api.github.com/users/davidmurdoch/repos","events_url":"https://api.github.com/users/davidmurdoch/events{/privacy}","received_events_url":"https://api.github.com/users/davidmurdoch/received_events","type":"User","site_admin":false},"created_at":"2019-11-07T00:01:41Z","updated_at":"2019-11-07T00:01:41Z","author_association":"MEMBER","body":"> > The truffle package itself doesn't have this problem, AFAIK, because the package is fully bundled and contains no install-time dependencies (someone please correct me if I'm wrong).\r\n> \r\n> I believe it does, just to a more limited extent:\r\n> \r\n> ```json\r\n> {\r\n>   \"dependencies\": {\r\n>     \"app-module-path\": \"^2.2.0\",\r\n>     \"mocha\": \"5.2.0\",\r\n>     \"original-require\": \"1.0.1\"\r\n>   },\r\n> }\r\n> ```\r\n\r\nWell, I stand corrected! :-D\r\n\r\n`original-require` doesn't have any external dependencies, so that one is effectively pinned. `app-module-path` doesn't have external dependencies either, but still allows for updated versions due to the loose semver. Then there is the pinned `mocha` which itself includes 23 pinned dependencies; I haven't checked if its transitive-dependencies are all pinned and locked (but I doubt it)."}}
{"actor":{"display_login":"davidmurdoch"}}