cloudfoundry / cloudfoundry/nodejs-buildpack
Misleading "PRO TIP" about missing "package-lock.json" (with `npm-shrinkwrap.json`)
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 174
- Forks
- 389
- PR merge metrics
- No merged PRs in 30d
Description
Problem Description
For our Node.js application, we always receive the following message:
-----> Creating runtime environment
PRO TIP: Warning: package-lock.json not found. The buildpack may reach out to the internet to download module updates, even if they are vendored.
Visit https://docs.cloudfoundry.org/buildpacks/node/index.html#offline_environments
Interestingly, in the next step the logs indicate that a prebuild was succssfully detected:
Prebuild detected (node_modules already exists)
Rebuilding any native modules
rebuilt dependencies successfully
Installing any new modules (package.json + npm-shrinkwrap.json)
We are using a npm-shrinkwrap.json instead of a package-lock.json. To my understanding, they should work the same for vendoring (also see https://stackoverflow.com/a/46132512).
Context
I checked the code that prints this message, and it seems to loop over two files package-lock.json and npm-shrinkwrap.json. The order of the files seems to be important for the following loop.
The loop goes over these files and if it does not find a file, it returns the "PRO TIP".
This does not make any sense for the npm-shrinkwrap.json (as the "PRO TIP" only mentions the package-lock.json).
And I also think it does not make sense to expect both the package-lock.json and npm-shrinkwrap.json (as they are basically the same file in different format).
Expected Behavior
I would expect that when you either have a package-lock.json or npm-shrinkwrap.json it does not show the "PRO TIP" and if none of these files are present the "PRO TIP" is shown and the message includes both options (either having a package-lock.json or npm-shrinkwrap.json).
Maybe, I am also missing something here (but I tried to look when/why the change was implemented and could not find anything that indicates the correctness of the current functionality).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/nodejs/supply/supply.go around lines 441-463, where the buildpack checks package-lock.json and npm-shrinkwrap.json and prints the PRO TIP. Reproduce the check with each lockfile present and with neither present. Done means either supported lockfile suppresses the warning, while the warning shown without either names both options.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, nodejs
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100