From b7d5c1d27dc549b3535ee6165db9d52bd4d4fe21 Mon Sep 17 00:00:00 2001 From: Daniel Hensby Date: Mon, 27 Jul 2026 13:43:50 +0100 Subject: [PATCH] build: pin npm via packageManager to keep lockfile deterministic Dependabot regenerates the lockfile with npm 11, which omits the nested @commitlint/read/node_modules/conventional-commits-filter@6.0.1 entry that npm 10 keeps. CI installs with the npm bundled in Node 22 (.nvmrc), i.e. npm 10, whose `npm ci` then rejects an npm-11 lockfile with "EUSAGE Missing: conventional-commits-filter@6.0.1 from lock file". Pinning packageManager to npm@10.9.8 makes lockfile generation deterministic across contributors and Dependabot, matching the npm that CI actually runs. No dependency versions change and the committed lockfile is unaffected. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- package.json | 1 + 1 file changed, 1 insertion(+) diff --git a/package.json b/package.json index 6be5f9a..b2eccf9 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,7 @@ { "name": "@tediousjs/connection-string", "version": "1.1.0", + "packageManager": "npm@10.9.8", "description": "SQL ConnectionString parser", "repository": { "type": "git",