nodejs: enforce exact npm dependency policy - #2700
roblourens wants to merge 2 commits into
Conversation
Pin Node.js production dependencies at their existing resolved versions and require external npm releases to age seven full days before release packaging. Preserve exact requirements in packed packages and default future npm saves to exact versions. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 823a3ba3-43a5-4b6a-be71-625e7660994a
This comment has been minimized.
This comment has been minimized.
|
Blocking issue: the seven-day publication-age verification currently checks only the direct Generated by Copilot |
stephentoub
left a comment
stephentoub
left a comment
There was a problem hiding this comment.
Approved with the blocking transitive-dependency policy gap documented in the separate review comment.
Generated by Copilot
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The exact-version, cooldown, packaging-verification, and test changes are consistent and complete.
Review effort: Balanced (auto)
Findings: None
Note
Copilot is running an experiment and ran this review at Balanced.
What changed in this PR
Enforces deterministic Node.js production dependencies and a seven-day npm publication cooldown before release packaging.
Changes:
- Pins production dependencies and defaults future saves to exact versions.
- Adds publication-age validation and release-manifest checks.
- Adds focused policy tests.
| File | Description |
|---|---|
nodejs/.npmrc |
Enables exact npm saves. |
nodejs/package.json |
Pins dependencies and adds policy verification. |
nodejs/package-lock.json |
Synchronizes resolved metadata. |
nodejs/samples/package-lock.json |
Synchronizes the sample lockfile. |
nodejs/scripts/dependency-policy.ts |
Implements dependency and publication-age rules. |
nodejs/scripts/verify-dependency-policy.ts |
Runs policy checks before packaging. |
nodejs/scripts/verify-release-packages.ts |
Verifies packed dependency manifests. |
nodejs/test/dependency-policy.test.ts |
Tests policy behavior and registry failures. |
nodejs/tsconfig.test.json |
Includes the new test in type-checking. |
Files not reviewed (2)
- nodejs/package-lock.json: Generated file
- nodejs/samples/package-lock.json: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Walk the package-lock v3 production closure so optional and transitive package versions are subject to the seven-day npm publication policy while dev-only packages remain excluded. (Written by Copilot) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 823a3ba3-43a5-4b6a-be71-625e7660994a
|
Addressed the documented gap in 4e0ab19. The policy now walks the The live check now covers 21 resolved production package versions and takes 0.62 seconds locally. I also added tests for optional, The PR description now explicitly states the remaining npm limitation: this validates the graph resolved and tested at release time, but a library's (Written by Copilot) |
SDK Consistency Review — PR #2700Scope of change: This PR only touches the Node.js package's build/release tooling — it adds a
It also pins Findings: No cross-SDK consistency issues. This change:
This falls under the "language-specific optimization/tooling" category — similar supply-chain protections (exact pinning + publication-age cooldown) could be a reasonable enhancement for other SDKs' release pipelines (uv/pip for Python, go.sum for Go, NuGet for .NET, Maven for Java, Cargo for Rust), but that would be a separate, non-blocking follow-up rather than a parity gap introduced by this PR. No inline review comments needed.
|
Summary
package-lock.jsonhas been published for at least seven full days before release packagingdevOptionalproduction nodes while excluding strictly dev-only, local-link, and bundled entriesWhy
The seven-day Dependabot cooldown added in #2596 delays dependency update PRs, but a published semver range can still resolve to a newer release immediately. Exact direct requirements keep downstream direct dependency selection deterministic while Dependabot continues to automate upgrades after the cooldown.
The lockfile closure check also prevents releasing when the complete production graph resolved and tested by CI contains a newly published external transitive or optional package. This includes Koffi's 18
@koromix/*optional platform packages.This unblocks downstream mirrored feeds such as VS Code's ADO feed, where newly published public npm packages may not be available until their quarantine period ends.
Scope
A library's
package-lock.jsonis not published or honored for consumer installs. This check therefore proves that the release-time production graph is at least seven days old, but it does not freeze future consumer resolution of ranges declared by transitive dependencies. Fully freezing that graph would require publishing annpm-shrinkwrap.jsonor bundling dependencies, which is outside this change.The selected direct production dependency versions and authoritative npm publication timestamps are:
koffi@3.2.1—2026-09-04T07:39:01.277Zvscode-jsonrpc@8.2.1—2024-05-21T13:53:09.125Zzod@4.3.6—2026-01-22T19:14:35.382Z@github/*packages remain exempt from the public npm publication-age check, matching the existing Dependabot cooldown configuration.Validation
npm ci --ignore-scriptsfor the Node SDK, test harness, and samplesnpm run format:checknpm run lint(five existing warnings, no errors)npm run typechecknpm run buildnpm test— 1,147 passed, 11 skippednpm run verify:dependency-policy— 3 exact direct dependencies and 21 resolved production package versions passed the seven-day checknpm run pack:releasenpm run verify:release-packages— nine release package tarballs verifiedgit diff --check(Written by Copilot)