Pin dependencies

[legendecas]

This pins all dependencies with a workspace package-lock.json (excluding the website/ folder)

[legendecas]

Going to merge this addressing a security advisary.

[bavulapati]

is this intentional to remove node test as well?

[legendecas]

Yes, the test should not run on install script.

[gengjiawen]

this cron exists for a reason, means to test nodejs nightly build. should be keep this if there is a strong reason.

[KevinEady]

@gengjiawen,

The CI does not test Node.js nightly builds, as it uses the actions/setup-node GitHub Action:

node-addon-examples/.github/workflows/nodejs.yml

Lines 26 to 29 in 1f9a247

	- name: Use Node.js ${{ matrix.node-version }}
	uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
	with:
	node-version: ${{ matrix.node-version }}

with:

node-addon-examples/.github/workflows/nodejs.yml

Line 16 in 1f9a247

node-version: [20.x, 22.x, 24.x]

Now that we use a package-lock.json with npm ci, there should be no changes across runs when there are no source and/or dependency changes.

[gengjiawen]

nope

node-addon-examples/.github/workflows/nodejs.yml

Line 49 in fa3cd35

- run: npm i -g n && n nightly

[KevinEady]

Ah I didn't see the other job. Thanks for pointing that out!

Well that's weird. I don't see why we would need to test with Node.js nightly, e.g. node-addon-api doesn't do it. The only thing that tests Node-API with nightly is the Node.js core repo itself...

[legendecas]

I don't have strong opinon on this cron job as long as we pin dependencies.

Reverted this removal.

[legendecas]

Hmm, strange. The CI failed for lock file's typescript@5.9.3 does not satisfy typescript@6.0.2. But there is no single reference to typescript@6.0.2

[legendecas]

Ah, #620 merged.