chore(deps): re-sync lockfile

[avivkeller]

Description

This is a chore re-sync of the lockfile. It's been a while since this file was re-generated, and it's important (IMO) to do it every once in a while.

All tests pass, storybook looks fine, and nothing crashes AFAICT on Chrome + Safari.

Validation

Nothing should change, and no tests should fail

Check List

• I have read the Contributing Guidelines and made commit messages that follow the guideline.
• I have run npm run format to ensure the code follows the style guide.
• I have run npm run test to check if all tests are passing.
• I have run npx turbo build to check if the website builds without errors.
• I've covered new added functionality with unit tests if necessary.

[Copilot]

Copilot reviewed 1 out of 1 changed files in this pull request and generated no comments.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Updated (UTC)
nodejs-org	✅ Ready (Inspect)	Visit Preview	Apr 9, 2025 5:48pm

[github-actions]

Lighthouse Results

URL	Performance	Accessibility	Best Practices	SEO	Report
/en	🟢 100	🟢 100	🟢 100	🟢 91	🔗
/en/about	🟢 100	🟢 100	🟢 100	🟢 91	🔗
/en/about/previous-releases	🟢 100	🟢 100	🟢 100	🟢 92	🔗
/en/download	🟠 89	🟢 100	🟢 100	🟢 91	🔗
/en/blog	🟢 100	🟢 100	🟢 96	🟢 92	🔗

[github-actions]

Unit Test Coverage Report

Title	Lines	Statements	Branches	Functions
@node-core/ui-components		95.83% (161/168)	77.86% (102/131)	88.57% (31/35)
@nodejs/website		84.7% (493/582)	76.03% (165/217)	86.88% (106/122)

Title	Tests	Skipped	Failures	Errors	Time
@node-core/ui-components	24	0 💤	0 ❌	0 🔥	4.736s ⏱️
@nodejs/website	156	0 💤	0 ❌	0 🔥	6.332s ⏱️

[draclyr]

good work❤️

[bmuenzenmeyer]

I'm -1 on the practice, as it's imprecise and very hard to review.

[AugustinMauroy]

I didn't get what is the issue why "updating" the lock file ?

[avivkeller]

Regenerating the lockfile ensures that the package versions we install are the best ones available. Over time, the file can slightly differ from its optimal state, mainly because Dependabot updates only a few packages at a time in isolation, not taking into account if a specific package has a better version available that suits our specified requirements.

[bmuenzenmeyer]

putting an explicit block on this til we have consensus

[MattIPv4]

I am -1 to this practice -- I have never encountered it before as a recommended thing to do, and it seems incredibly risky / complex to review. If we're going to do this, why have a lockfile at all? I'd much rather see PRs to bump individual transitive dependencies that we know need updating for a specific reason, and beyond that just let them naturally update as direct dependencies require.

[avivkeller]

I think enough of us have said -1 to this PR that it shouldn't land, and we should continue discussion on https://openjs-foundation.slack.com/archives/CVAMEJ4UV/p1744401326173889.

Sorry for the noise, everyone!