From eb42fbecb7cfa2e44924e46f4eed31aebf041cb0 Mon Sep 17 00:00:00 2001 From: Adam Wright Date: Tue, 27 Oct 2026 00:47:33 +0000 Subject: [PATCH] Content service image: its packages at the lockfile's versions From #699's review: neo4j-driver's root range (^6.2.0) let the image take the newest 6.x at build time, untested here. Each package must still be a dependency of the root package.json, and is installed at the version the root lockfile resolved for it; one missing from either fails the build, naming it. Today that is express 5.3.0 and neo4j-driver 6.2.0, as before. Co-Authored-By: Claude Opus 5.5 --- deploy/content-node/Dockerfile | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) diff --git a/deploy/content-node/Dockerfile b/deploy/content-node/Dockerfile index 26bc8b377..8169093ff 100644 --- a/deploy/content-node/Dockerfile +++ b/deploy/content-node/Dockerfile @@ -7,20 +7,27 @@ FROM node:24 WORKDIR /content-node -# Only what the service imports, at the versions the root package.json pins, -# read from it rather than restated here (as the render service does). The -# repository's own lockfile would drag in Angular, Playwright and the CMS to -# run two packages. A pin restated here stayed at express 5.2.1 when -# Dependabot moved the root to 5.3.0 (it watches only the root), so the image -# would have run a version nothing here tested. +# Only what the service imports, at the versions the repository resolves and +# tests: each must be a dependency of the root package.json, and is installed +# at the version the root lockfile resolved for it. The repository's own +# lockfile would drag in Angular, Playwright and the CMS to run two packages. +# A pin restated here stayed at express 5.2.1 when Dependabot moved the root +# to 5.3.0 (it watches only the root); a range read from package.json +# (neo4j-driver's ^6.2.0) would take the newest 6.x at build time, untested. +# Their own dependencies still resolve at build time, within express's and +# the driver's ranges. COPY package.json ./root-package.json +COPY package-lock.json ./root-lock.json RUN node -e " \ const root = require('./root-package.json'); \ + const lock = require('./root-lock.json'); \ const dependencies = {}; \ for (const name of ['express', 'neo4j-driver']) { \ - const version = (root.dependencies ?? {})[name]; \ - if (!version) throw new Error(name + ' is not a dependency of the root package'); \ - dependencies[name] = version; \ + if (!(root.dependencies ?? {})[name]) \ + throw new Error(name + ' is not a dependency of the root package'); \ + const locked = (lock.packages ?? {})['node_modules/' + name]; \ + if (!locked?.version) throw new Error(name + ' is not in the root lockfile'); \ + dependencies[name] = locked.version; \ } \ require('node:fs').writeFileSync('package.json', JSON.stringify({ \ name: 'reactome-content-node', private: true, dependencies \ @@ -28,7 +35,7 @@ RUN node -e " \ " \ && npm install --omit=dev --no-audit --no-fund \ && npm cache clean --force \ - && rm root-package.json + && rm root-package.json root-lock.json COPY tools/content-node/ ./tools/content-node/ # The nearest package.json is what tells Node a .ts module is a module (spec