Previous attempt failed by design of `npm pack` / `npm publish`,
as documented at https://docs.npmjs.com/cli/v6/configuring-npm/package-lock-json :
> One key detail about package-lock.json is that it cannot be published,
> and it will be ignored if found in any place other than the toplevel
> package. It shares a format with npm-shrinkwrap.json, which is
> essentially the same file, but allows publication.
>
> This is not recommended unless deploying a CLI tool or otherwise using
> the publication process for producing production packages.
, and we are a CLI tool. Switching to shrinkwrap.
They were used a long time ago, then I scrapped them for simplicity to
new contributors. I'm re-considering this and re-introducing one, for
two (maybe three) reasons:
1. Reading on supply chain attacks
2. Build broken because of a dep change (see previous commit broken
because of a change in yargs @ 17.1.0)
(3.) Performance
* Update deps except eslint
* Update eslint and lint:fix (WIP, needs manual fixing for remaining 44 problems)
* Manually fix remaining eslint errors
* Document deprecation of `version-string` as of electron-packager 9.0.0
* Upgrade to Electron 1.7.9 (chrome-58, node-7.9.0, v8-5.8)
* npm: Disable generation of package-lock.json and gitignore it
--Trying this, package-lock is a pain in PRs. May not be a good idea
(obviously we lose deps pinning), will revert if necessary.--
* npm tasks: add dev-up-win for Windows developers,
and e2e for end-to-end tests. Update docs.
* Move normalizeUrl test to a jest unit test, makes no sense to be in the mocha e2e tests
* Switch from babel-preset-es2015 to babel-preset-env,
with target.node=4.0. Seem like it's today's most convenient
way to support the latest ES and let babel transpile to what
makes sense for our currently minimal node version
Ronan Jouchet