Problem
Dependabot bumps frequently and lockfiles drift. A lockfile out of sync with package.json silently breaks npm ci in CI and for contributors, and unused dependencies have crept in (e.g. the removed Lobstr signer-extension-api).
Scope
- Add a CI check that runs
npm install --package-lock-only and fails if the lockfile changes.
- Audit
package.json for unused deps (run npm ls, check imports) and remove them in the same PR.
Stop
- Don't upgrade major versions — sync/prune only.
Definition of Done
- CI fails on lockfile drift;
npm ls reports no extraneous packages; build passes.
Problem
Dependabot bumps frequently and lockfiles drift. A lockfile out of sync with package.json silently breaks
npm ciin CI and for contributors, and unused dependencies have crept in (e.g. the removed Lobstr signer-extension-api).Scope
npm install --package-lock-onlyand fails if the lockfile changes.package.jsonfor unused deps (runnpm ls, check imports) and remove them in the same PR.Stop
Definition of Done
npm lsreports no extraneous packages; build passes.