openvibers/openvibe.news Commits

Restore the openvibe-publishing sha512 integrity in the lockfile

OP OpenVibers committed 4 Oct 2026 · 38828d8d1b · 3 files, +27 −0

Asked: Follow-up of https://github.com/OpenVibers/OpenVibe.Reviews/pull/7 (Render Reviews pages through openvibe-publishing/layout shell): its review asked for a change in OpenVibe.News that the PR cannot make from OpenVibe.Reviews. The review said: VERDICT: FIX
Harness job news-follow-up-of-https-github-com-openv-133926.

Changes

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 37b0d9e..4981859 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -3,3 +3,4 @@
  ## Unreleased
  
  - Every page is rendered through `openvibe-publishing/layout` (v1.2.0, on `openvibe-shared/shell` v2.6.0): the head, the Frame, the noscript navigation, the footer and its init come from the shared document; robots and the canonical still come from the indexability gate's decision. The shell adds `web-runtime.js`, so the home page's JS budget is raised to 5 files, 245 KB, 59 KB brotli.
++- The `openvibe-publishing` v1.2.0 lock entry carries its sha512 integrity again (the bump had dropped it), and a test fails if any codeload pin loses its hash.
ddiff --git a/package-lock.json b/package-lock.json
iindex bfec24c..8d08272 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1165,6 +1165,7 @@
      "node_modules/openvibe-publishing": {
        "version": "1.2.0",
        "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Publishing/tar.gz/refs/tags/v1.2.0",
++      "integrity": "sha512-n/20yxXo5jRs0wi7KsR+R9jDkGsoBak3gqElHV6XyU+i1t3XCzaoz+sDb10G2cbc4uEaNB/F09VtQKrQzLp6YQ==",
        "license": "MIT",
        "engines": {
          "node": ">=20"
ddiff --git a/test/lockfile.test.js b/test/lockfile.test.js
nnew file mode 100644
iindex 0000000..f6420f1
---- /dev/null
++++ b/test/lockfile.test.js
@@@ -0,0 +1,25 @@
++'use strict';
++/**
++ * Every dependency pinned to a GitHub tag carries the sha512 its tarball hashes to. A hand-edited
++ * bump of a codeload pin can silently drop that line (the Reviews layout PR did), so the entry is
++ * checked here instead of being noticed only when a sibling copies the missing hash.
++ */
++const assert = require('assert');
++const fs = require('fs');
++const path = require('path');
++const { check, done } = require('./helpers/boot');
++
++const ROOT = path.join(__dirname, '..');
++
++(async () => {
++    await check('every codeload dependency in package-lock.json pins a sha512 integrity', () => {
++        const lock = JSON.parse(fs.readFileSync(path.join(ROOT, 'package-lock.json'), 'utf8'));
++        const missing = Object.entries(lock.packages || {})
++            .filter(([, p]) => typeof p.resolved === 'string' && p.resolved.startsWith('https://codeload.github.com/'))
++            .filter(([, p]) => !p.integrity)
++            .map(([name, p]) => `${name}@${p.version || '?'}`);
++        assert.deepStrictEqual(missing, [], `lock entries without integrity: ${missing.join(', ')}`);
++    });
++
++    done();
++})();