![](https://raw.githubusercontent.com/yoavain/fix-lockfile-integrity/main/resources/docs/logo.gif)
# Fix Lockfile Integrity 
[![Actions Status](https://github.com/yoavain/fix-lockfile-integrity/workflows/Node%20CI/badge.svg)](https://github.com/yoavain/fix-lockfile-integrity/actions)
![node](https://img.shields.io/node/v/fix-lockfile-integrity.svg)
![types](https://img.shields.io/npm/types/typescript.svg)
![commit](https://img.shields.io/github/last-commit/yoavain/fix-lockfile-integrity.svg)
![license](https://img.shields.io/npm/l/fix-lockfile-integrity.svg)
[![CodeQL](https://github.com/yoavain/fix-lockfile-integrity/workflows/CodeQL/badge.svg)](https://github.com/yoavain/fix-lockfile-integrity/actions?query=workflow%3ACodeQL)
[![fix-lockfile-integrity](https://snyk.io/advisor/npm-package/fix-lockfile-integrity/badge.svg)](https://snyk.io/advisor/npm-package/fix-lockfile-integrity)
[![Known Vulnerabilities](https://snyk.io/test/github/yoavain/fix-lockfile-integrity/badge.svg?targetFile=package.json)](https://snyk.io//test/github/yoavain/fix-lockfile-integrity?targetFile=package.json)
[![codecov](https://codecov.io/gh/yoavain/fix-lockfile-integrity/branch/main/graph/badge.svg)](https://codecov.io/gh/yoavain/fix-lockfile-integrity)
[![Renovate](https://img.shields.io/badge/renovate-enabled-brightgreen.svg)](https://renovatebot.com)
![visitors](https://visitor-badge.glitch.me/badge?page_id=yoavain.fix-lockfile-integrity)
![Downloads](https://img.shields.io/npm/dm/fix-lockfile-integrity.svg)

**Fix `sha1` integrity in lock files back to `sha512`**

## Features
- Reverts all `sha1` back to `sha512` which is more secure
- Works with both package-lock.json and npm-shrinkwrap.json
- Works with lockfile version 1, 2 & 3
- Finds monorepo workspace folders automatically (npm, yarn, lerna), or works on configured paths
- Works only on file system without touching your version control


## Limitations
- By default, fixes only packages from npm registry [registry.npmjs.org](https://www.npmjs.com/). You can change that via configuration file


## Installation

Install globally:

```sh
npm install -g fix-lockfile-integrity
```

Or run with [npx](https://docs.npmjs.com/cli/v8/commands/npx):

```sh
npx fix-lockfile-integrity
```

## Usage

Check local folder for a lockfile (package-lock.json or npm-shrinkwrap.json) and fix any `sha1` in it.
In a monorepo, the workspace folders are checked too — see [Monorepo support](#monorepo-support).

```sh
$ fix-lockfile
Overwriting lock file ./package-lock.json with 10 integrity fixes
```

> **Make sure your lock file is in version control and all changes have been committed. This _will_ overwrite your lock file.**

To fix a specific file not in the current folder:

```sh
$ fix-lockfile <file>
```

## CLI Options
```
Usage: fix-lockfile [options] [file]

Fix lock file integrity

Positionals:
  file  file to fix (default: looks for package-lock.json/npm-shrinkwrap.json in running folder)

Options:
  -c, --config              configuration file                [string]
  -v, --verbose             verbose logging                   [boolean]
  -q, --quiet               quiet (suppresses verbose too)    [boolean]
      --disable-workspaces  do not detect workspace folders   [boolean]
  -h, --help                Show help                         [boolean]

Examples:
  fix-lockfile --config fix-lockfile.config.json package-lock.json
  fix-lockfile --quiet
```

## Configuration file

A configuration file is loaded automatically, in any of the formats below.  
You can also give the path to one with `--config` (alias: `-c`).

### TypeScript

`.fix-lockfile.ts` or ` fix-lockfile.config.ts`

```ts
import type { FixLockFileIntegrityConfig } from "fix-lockfile-integrity";

const config: FixLockFileIntegrityConfig = {
    includePaths: ["./", "./packages/a", "./packages/b"],
    lockFileNames: ["package-lock.json"],
    allRegistries: true,
    prettier: {
        useTabs: true,
        endOfLine: "cr"
    }
};

export default config;
```

### JavaScript

`.fix-lockfile.js` or ` fix-lockfile.config.js`

```js
const config = {
    includePaths: ["./", "./packages/a", "./packages/b"],
    lockFileNames: ["package-lock.json"],
    allRegistries: true,
    prettier: {
        useTabs: true,
        endOfLine: "cr"
    }
};

module.exports = config;
```

### JSON

`.fix-lockfile.json` or ` fix-lockfile.config.json`

```json
{
    "includePaths": ["./", "./packages/a", "./packages/b"],
    "lockFileNames": ["package-lock.json"],
    "allRegistries": true,
    "prettier": {
        "useTabs": true,
        "endOfLine": "cr"
    }
}
```

### Monorepo support

In a monorepo, the tool finds the workspace folders on its own. No configuration is needed. It reads:

1. `workspaces` in `package.json` — npm and yarn, in the array form or the object form
2. `packages` in `lerna.json` — legacy Lerna projects
3. `packages/*` — when `lerna.json` holds no `packages` property

```sh
$ fix-lockfile --verbose
Detected workspace ./packages/a
Detected workspace ./packages/b
```

A workspace folder without a lock file is skipped. Therefore npm workspaces, which keep one lock file in the
root folder, need no change.

To stop the detection, use `--disable-workspaces`, or set `includeWorkspaces: false`.

For a layout with no workspace definition, list the folders in `includePaths`:

```json
{
    "includePaths": ["./", "./packages/a", "./packages/b"]
}
```

Notes:
- `includePaths` holds folders. It does not accept glob patterns, for example `packages/*`.
- A folder in `includePaths` without a lock file fails the run. A detected workspace folder always holds one.
- The paths resolve against the folder that you run the tool from.
- pnpm and yarn write `pnpm-lock.yaml` and `yarn.lock`. This tool does not fix those files.

### Configuration options
```
- includeFiles:      Explicit list of files to fix       (default: none)
- includePaths:      Paths to look for lock files in     (default: ".")
- includeWorkspaces: Add the detected workspace folders  (default: true)
- lockFileNames:     Lock files to look for              (default: ["package-lock.json", "npm-shrinkwrap.json"])
- allRegistries:     Fetch integrity from all registries (default: false)
- registries:        Registries to fetch integrity from  (default: ["registry.npmjs.org"])
- prettier:          Overriding prettier config in case needed
```

## Automation

If you want to make sure to avoid those `sha1` in your files and avoid unnecessary changes in PRs, you should do one of the following:

#### 1) Add to postinstall
This way it will run after each time you run `npm install`
```json
{
    "postinstall": "fix-lockfile package-lock.json"
}
```
In a monorepo, use `fix-lockfile` without a file name. A file name turns the workspace detection off.

#### 2) pre-commit hook
Using husky (or alike) to run as a pre-commit hook


## Why?

NPM has known issue of constantly changing integrity property of its lock file. Integrity may change due to plenty of reasons. Some of them are:

1. npm install done on machine with different OS from one where lock file generated
2. some package version updated
3. another version of npm used

Intention of this tool is to prevent such changes and make integrity property secure and reliable.


## Report issues

If something doesn't work, please [file an issue](https://github.com/yoavain/fix-lockfile-integrity/issues/new).