Ability to validate lockfileVersion about lockfile-lint

[appsbytom]

Very true, thanks again for the suggestions 😄

[lirantal]

Totally understand where this is helpful to force a specific one version for the team, but I think this shouldn't be done with lockfile-lint, but rather with something like nvm's .nvmrc (see here: https://github.com/nvm-sh/nvm#nvmrc) or if you use fnm then the corresponding config.

Does that make sense?

[appsbytom]

I see what you mean with .nvmrc however that doesn't force the version as the developer needs to remember to run nvm use. So it's possible if the developer uses a different default Node version to what the project uses it can be missed.
Also using a specific Node version doesn't always mean that the npm versions are the same.

Current example is, I use the default npm version with Node 10 however a team member had upgraded to the latest npm while still on Node 10. This meant I was on lockfileVersion 1 and they were on 2

[lirantal]

lockfileVersion 2 is actually backwards compatible with lockfileVersion 1 :-)

So, some ideas for other workarounds that can apply here:

1. You can specify the Node.js runtime versions, and also the npm runtime version with package.json's engines field. See here
2. You can also explicitly have a .npmrc file with a lockfile-version configuration setting to force it.

Any of this is helpful?

[appsbytom]

It may be compatible but we had the issue of the package-lock rewriting itself to match the correct schema for the npm version used and switching back and forth. So wanted to have something that would automatically flag this.

lockfile-version in .npmrc is a good idea though, thanks.

Looking more at .npmrc, wouldn't the registry key do similar as to the checks here for hosts, https?

[lirantal]

lockfile-version in .npmrc is a good idea though, thanks.

🤗

Looking more at .npmrc, wouldn't the registry key do similar as to the checks here for hosts, https?

Nope. It doesn't force a trust policy, but merely sets the default upstream repository for when you do npm install.

[lirantal]

Anytime!
Thank you for bringing this up and brainstorming with us ❤️