npm / arborist / #109

push

Only use hidden lockfile if up to date

Compare the mtime of the hidden lockfile at
node_modules/.package-lock.json against all package folders in
node_modules, and ensure that all packages in node_modules exist in the
lockfile data.

This of course still can be thwarted by editing a single file within a
package folder, but not adding or deleting any files or folders, or
modifying files in nested subfolders in a package in any way whatsoever.

However, it prevents the overwhelming majority case where this would
bite us, which is someone installing something with yarn or previous
versions of npm.

In those cases, we ignore the hidden lockfile, meaning that any
loadActual call will read the files on disk as normal.

1898 of 1905 branches covered (99.63%)

Branch coverage included in aggregate %.

2833 of 2840 relevant lines covered (99.75%)

311.14 hits per line