No lockfile + loosely-pinned dependencies makes builds fragile to upstream drift

[michielbdejong]

Problem

OLSKBundleClearPackageLock() (invoked from olsk-bundle, this repo's setup/postinstall step) deliberately deletes package-lock.json, and several dependencies are pinned loosely (git refs with no commit SHA, "latest", bare majors). This means the exact dependency graph resolved on any given day is not reproducible.

Concrete instance

While working on #1, npm run build failed with:

TypeError: require(...) is not a constructor
  at OLSKRollupPluginLocalize/main.js:62 -> new (require('magic-string'))(...)

because the unpinned transitive magic-string resolved to 1.1.0, which is ESM-only ("type": "module", no CJS entry) — incompatible with the require() call. Fixed for now via a package.json overrides pin to ^0.25.0, but the same class of break can recur with any other loosely-pinned transitive dependency whenever upstream publishes a new major.

Suggested next steps

• Consider committing a lockfile (tension with OLSKBundleClearPackageLock's intent — worth a design discussion across the OLSK toolchain, not just this repo)
• Or: audit and pin the dependencies most likely to break (build-time rollup/babel plugins, similar to the magic-string override already added)

https://claude.ai/code/session_01AcjKc8vk2fb84yYZsE8k5d

[michielbdejong]

Leaving this open rather than acting on it — the two options I listed (committing a lockfile vs. auditing/pinning likely-to-break deps) trade off differently:

• A lockfile directly conflicts with OLSKBundleClearPackageLock()'s intent in the shared olsk-bundle tool, so changing it here alone wouldn't stick without either overriding that behavior in this repo or a coordinated change across the OLSK toolchain.
• Pinning individual dependencies (like the magic-string override already in place) is safe to do incrementally but only fixes problems as they're discovered — it's a mitigation, not a systemic fix.

This needs a maintainer call on which direction to take before I pick one and start pinning/reverting things. Let me know which way you'd like to go and I can implement it.

---

Generated by Claude Code