fix(dev): make dependency install registry-agnostic and npm 12 compatible - #12
Merged
Conversation
…ible - Add .npmrc with omit-lockfile-registry-resolved=true: the lockfile no longer records registry hosts, so installs work with any registry or mirror and no longer hit npm 12's EALLOWREMOTE when the lockfile was generated against a mirror registry. - Rewrite package-lock.json via npm install --package-lock-only: strip 692 'resolved' URLs (all integrity hashes preserved, no version drift). - Declare allowScripts for native/build deps (better-sqlite3, electron, esbuild, lzma-native): npm 12 blocks install scripts by default, this keeps npm ci working out of the box for all contributors. Verified: npm ci passes with the official registry and with registry.npmmirror.com.
审阅者指南（在小型 PR 上折叠）审阅者指南此 PR 更新了 npm 配置和元数据，使依赖安装在不同的 registry 上都能可靠运行，并与 npm 12 更严格的远程和脚本策略兼容。 适配 npm 12、与 registry 解耦的依赖安装流程图flowchart TD
A[开发者运行 npm ci 或 npm install] --> B[npm 读取项目 .npmrc]
B --> C[omit-lockfile-registry-resolved=true]
C --> D[npm 在解析 package-lock.json 时不使用绑定到特定 registry 的 resolved URL]
D --> E[npm 从当前配置的 registry 下载 tarball]
A --> F[npm 读取 package.json allowScripts]
F --> G[允许 better-sqlite3、electron、esbuild、lzma-native 的安装脚本]
F --> H[其他依赖的安装脚本仍然遵循 npm 12 的默认阻止策略]
E --> I[在不同 registry 上安装均可成功完成]
G --> I
H --> I
文件级变更
技巧与命令与 Sourcery 交互
自定义你的体验访问你的 控制面板 以：
获取帮助Original review guide in EnglishReviewer's guide (collapsed on small PRs)Reviewer's GuideThis PR updates npm configuration and metadata to make dependency installation work reliably across different registries and with npm 12’s stricter remote and script policies. Flow diagram for npm 12-compatible, registry-agnostic dependency installationflowchart TD
A[Developer runs npm ci or npm install] --> B[npm reads project .npmrc]
B --> C[omit-lockfile-registry-resolved=true]
C --> D[npm interprets package-lock.json without registry-bound resolved URLs]
D --> E[npm downloads tarballs from current configured registry]
A --> F[npm reads package.json allowScripts]
F --> G[Scripts for better-sqlite3, electron, esbuild, lzma-native are allowed]
F --> H[Other dependency install scripts remain blocked by npm 12 defaults]
E --> I[Installation completes successfully across different registries]
G --> I
H --> I
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题背景
在全新环境中执行
npm install时，安装过程会失败并报错：原因是 npm 12 引入了新的远程依赖安全策略，
allow-remote默认值调整为none：Upcoming breaking changes for npm v12:
--allow-remotedefaults tonone当前
package-lock.json是在使用镜像 registry 的环境中生成的，其中记录了指向registry.npmmirror.com的 tarball URL。当开发者使用 npm 12 或更高版本，并将 registry 配置为官方源时，lockfile 中的 tarball 主机与当前 registry 不一致。npm 会将该地址识别为未经允许的远程依赖，并以
EALLOWREMOTE拒绝下载。修复内容
1. 避免 lockfile 绑定特定 registry
新增项目级
.npmrc：omit-lockfile-registry-resolved=true启用该配置后，
package-lock.json不再记录普通 registry 依赖的 tarball URL。安装时，npm 会根据开发者当前配置的 registry 解析实际下载地址。这样可以避免 lockfile 绑定生成者使用的官方源、镜像源或企业代理，提高其在不同开发环境中的可移植性。
现有
package-lock.json已按照该配置重新规范化。2. 显式批准必要的安装脚本
在
package.json中新增：{ "allowScripts": { "better-sqlite3": true, "electron": true, "esbuild": true, "lzma-native": true } }npm 12 默认限制未经批准的依赖安装脚本。上述依赖需要在安装阶段下载平台二进制文件、加载预编译原生模块或执行本地构建，因此需要显式加入允许列表。
提交该配置后，开发环境和 CI 可以在不依赖个人 npm 配置的情况下完成安装。
验证结果
使用官方 registry 执行
npm ci，安装成功使用镜像 registry 执行
npm ci --registry=https://registry.npmmirror.com，安装成功执行
npm run compile，TypeScript 类型检查和 esbuild 打包均通过后续注意事项
omit-lockfile-registry-resolved是 npm 12 引入的配置。如果使用旧版本 npm 添加或更新依赖，npm 可能重新向
package-lock.json写入resolved字段。提交前应使用项目规定的 npm 版本执行：然后检查
package-lock.json的变更，确保其中没有重新写入与个人环境相关的 registry 地址。Summary by Sourcery
提升在不同注册表和 npm 版本之间安装依赖的兼容性。
改进内容：
.npmrc配置，避免将锁文件绑定到特定注册表，从而提升可移植性。package-lock.json，使其符合与注册表无关的锁文件行为。Original summary in English
Summary by Sourcery
Improve npm dependency installation compatibility across different registries and npm versions.
Enhancements: