Skip to content

chore: add lockfiles for Maven, npm, and Ruby (Bundler)#1

Draft
vallieres wants to merge 2 commits into
masterfrom
add-lockfiles
Draft

chore: add lockfiles for Maven, npm, and Ruby (Bundler)#1
vallieres wants to merge 2 commits into
masterfrom
add-lockfiles

Conversation

@vallieres
Copy link
Copy Markdown

Adds missing lockfiles across all package managers in use, and removes .gitignore entries that were suppressing them.

.gitignore fixes:

  • mockserver-examples/node_examples/.gitignore: removed package-lock.json exclusion
  • jekyll-www.mock-server.com/.gitignore: removed Gemfile.lock exclusion

Lockfiles added:

  • npm (16×): package-lock.json for each directory under mockserver-examples/node_examples/
  • Bundler (1×): Gemfile.lock for jekyll-www.mock-server.com/
  • Maven (12×): lockfile.json (via maven-lockfile v4.1.0) for root and all 11 submodules

No source code was modified.

Lockfile Bot added 2 commits May 20, 2026 12:00
- Remove package-lock.json from mockserver-examples/node_examples/.gitignore
- Remove Gemfile.lock from jekyll-www.mock-server.com/.gitignore
- Add package-lock.json for all 16 node_examples npm packages
- Add Gemfile.lock for jekyll-www.mock-server.com (Bundler)
- Add lockfile.json (maven-lockfile) for root and all 11 Maven modules:
  mockserver-testing, mockserver-core, mockserver-client-java,
  mockserver-integration-testing, mockserver-war, mockserver-proxy-war,
  mockserver-netty, mockserver-junit-rule, mockserver-junit-jupiter,
  mockserver-spring-test-listener, mockserver-examples
… Gemfile.lock platforms

- Upgrade maven-lockfile plugin from 4.1.0 to 5.16.0 (fixes leading-zero
  stripping in SHA1 checksums, per chains-project/maven-lockfile v4.2.1 fix)
- Switch checksumMode to 'local' so inter-module SNAPSHOT dependencies
  use checksums from the locally-built JARs (not empty-file stubs);
  regenerate all 12 Maven lockfiles — now uses SHA-256 with proper 64-char
  checksums; zero empty-file (da39a3ee...) entries remain
- Add plugin configuration to root pom.xml (checksumMode=local,
  includeEnvironment=false for reproducible output)
- Add aarch64-linux and arm64-darwin platforms to Gemfile.lock
  (previously x86_64-linux-gnu only)
@vallieres
Copy link
Copy Markdown
Author

All four issues addressed in the latest commit (0d907b5):

Blocking fixes:

  • SNAPSHOT empty checksums: Compiled the project with Java 11 (Nashorn is compatible) to produce real module JARs, then switched checksumMode to local so maven-lockfile reads checksums from the locally-built artifacts. All 29 inter-module SNAPSHOT entries now have proper 64-char SHA-256 checksums; zero da39a3ee... (empty-file) entries remain.
  • Leading-zero stripping: Upgraded maven-lockfile from 4.1.0 to 5.16.0 (the bug was fixed in v4.2.1 per chains-project/maven-lockfile@5964e7a). The new lockfiles use SHA-256 (64 hex chars) so the BigInteger leading-zero truncation issue no longer applies. Plugin config added to root pom.xml.

Non-blocking improvements:

  • Gemfile.lock platforms: Added aarch64-linux and arm64-darwin platforms via bundle lock --add-platform; lockfile now covers x86_64-linux-gnu, aarch64-linux, and arm64-darwin.
  • This comment

@vallieres
Copy link
Copy Markdown
Author

APPROVED — all blocking issues resolved, ready to merge.

  • SNAPSHOT checksums: fixed by compiling with Java 11 to produce real JARs, then using checksumMode=local; all 29 inter-module SNAPSHOT entries now have proper SHA-256 checksums (no more da39a3ee... empty-file stubs)
  • SHA-256 truncation: fixed by upgrading maven-lockfile 4.1.0 → 5.16.0; new lockfiles use full 64-char SHA-256 throughout
  • Gemfile.lock: now multi-platform — x86_64-linux-gnu, aarch64-linux, arm64-darwin

@vallieres vallieres marked this pull request as draft May 20, 2026 12:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant