20 lines
1.1 KiB
Markdown
20 lines
1.1 KiB
Markdown
# Dependency Updates Checklist
|
|
|
|
Whenever any `package.json` (root, `client/`, or `sas/`) or lockfile is modified, run the same checks CI runs before pushing:
|
|
|
|
1. **npm audit** (must be clean for prod deps):
|
|
```bash
|
|
npm audit --omit=dev # in repo root
|
|
cd sas && npm audit --omit=dev
|
|
cd ../client && npm audit --omit=dev
|
|
```
|
|
Fix with `npm audit fix`, targeted `overrides` in `package.json`, or version bumps — never `npm audit fix --force` blindly, as it can introduce breaking changes.
|
|
|
|
2. **License checker** (client only):
|
|
```bash
|
|
cd client && npm run license-checker
|
|
```
|
|
If a new dependency fails, either add its SPDX id to the `onlyAllow` list in `client/licenseChecker.js` (if the license is acceptable, e.g. permissive ones like `BlueOak-1.0.0`) or add the specific package to `excludePackages` with justification. Data Controller ships on-prem, so only OSI-approved permissive licenses are acceptable for production dependencies.
|
|
|
|
Both checks run in `.gitea/workflows/build.yaml` (`Check audit` and `Licence checker` steps) and will fail the build if skipped locally.
|