chore: generate and publish npm-shrinkwrap.json to lock full dependency tree

[jonathannorris]

Summary

• Adds npm-shrinkwrap.json generation to the publish pipeline via a new prepack step, locking the full transitive dependency tree to the exact versions resolved at build time
• Pins all 27 production dependencies to exact versions (removing ^ and ~ ranges) as defense-in-depth
• scripts/generate-shrinkwrap.js handles the full flow: generates the lockfile via npm install --package-lock-only, converts it to shrinkwrap, strips workspace entries (mcp-worker), and protects yarn.lock from npm's Berry-incompatible rewrite via a save/restore in a finally block

Motivation

package.json already listed /npm-shrinkwrap.json in the files array but the file was never generated, so consumers running npm install -g @devcycle/cli resolved all caret-ranged transitive deps to whatever was latest at install time. This is the same class of exposure that let the malicious axios@1.14.1 reach users on March 31. Pinning axios directly in 6.3.0 only covers one package; the shrinkwrap covers the full tree.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	devcycle-mcp-server	8b3a95f	Apr 03 2026, 09:11 PM

[Copilot]

Pull request overview

Adds automated npm-shrinkwrap.json generation during publish to fully lock the transitive dependency tree shipped to npm consumers, and pins direct production dependencies to exact versions.

Changes:

• Add a prepack step to generate npm-shrinkwrap.json (and adjust postpack cleanup).
• Pin production dependencies in package.json (and update yarn.lock accordingly).
• Add helper scripts for shrinkwrap generation and (future) verification; ignore generated artifacts in .gitignore.

Reviewed changes

Copilot reviewed 3 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
yarn.lock	Updates lock entries to reflect newly pinned dependency versions/ranges.
scripts/verify-shrinkwrap.js	New verifier/cleaner for shrinkwrap contents vs installed node_modules (not wired yet).
scripts/generate-shrinkwrap.js	New generator invoked from prepack to create shrinkwrap while protecting yarn.lock.
package.json	Adds shrinkwrap generation to prepack, expands postpack cleanup, pins dependencies, adds shrinkwrap script.
.gitignore	Ignores generated shrinkwrap/lock artifacts and yarn.lock backup file.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

process.exit(1) inside the catch prevents the finally block from running, so yarn.lock may remain in the corrupted Yarn v1 format if npm install/npm shrinkwrap fails. Instead, capture the error, restore yarn.lock in finally, then exit (e.g., set process.exitCode = 1 and return, or rethrow after finally).

[Copilot]

This script claims to generate shrinkwrap for production deps only (and verify-shrinkwrap.js assumes --omit=dev), but the npm commands here don't omit dev dependencies. That will include dev packages in package-lock.json/npm-shrinkwrap.json and can publish a larger-than-intended dependency tree. Add --omit=dev (and ensure it applies to both the lock generation and shrinkwrap conversion).

Suggested change

	execSync('npm install --package-lock-only --ignore-scripts', {
	cwd: ROOT,
	stdio: 'inherit',
	})
	console.log('Converting package-lock.json to npm-shrinkwrap.json...')
	execSync('npm shrinkwrap', {
	execSync('npm install --package-lock-only --ignore-scripts --omit=dev', {
	cwd: ROOT,
	stdio: 'inherit',
	})
	console.log('Converting package-lock.json to npm-shrinkwrap.json...')
	execSync('npm shrinkwrap --omit=dev', {

[Copilot]

The script skips @types/* packages while asserting they have “no runtime or security impact”. Even though they’re type-only at runtime, they are still installed by consumers and could theoretically contain install scripts or malicious payloads. Consider including @types/* in verification, or at minimum adjust the comment/output so it doesn’t claim there is no security impact.