build(deps): Add missing resolved and integrity for all dependencies

[ljxfstorm]

TLDR

Updated the package-lock.json to ensure all dependencies have the resolved and integrity fields populated.

Dive Deeper

When attempting to update the package of this project using the Nix package manager, the build fails. This is because Nix's build process is heavily sandboxed and relies on fixed-output derivations. It requires the integrity hash to verify package contents and the resolved URL to fetch them deterministically, disallowing any unexpected network access during the build phase.
The previous package-lock.json was missing these fields for several dependencies since 0.1.7. This PR addresses the issue by adding them back, which facilitates downstream packaging and improves overall build reproducibility.

Reviewer Test Plan

Since this PR only modifies the lockfile, the primary goal is to verify that it doesn't introduce any regressions.

1. Inspect the Diff: Look at the package-lock.json diff. The changes should be the addition of resolved and integrity lines, not unexpected or major version bumps of dependencies.
2. Verify the dependencies:
   • Run the following jq command with package-lock.json (before this change). It will list several external dependencies that are missing the fields:

     jq '.packages | to_entries[] | select((.value | has("resolved") | not) or (.value | has("integrity") | not)) | .key' package-lock.json

   • Run the command again with this PR's package-lock.json. It will list as below:

     ""
     "node_modules/@google/gemini-cli"
     "node_modules/@google/gemini-cli-core"
     "packages/cli"
     "packages/core"
     

   This confirms that all external dependencies have the resolved and integrity fields.
3. Run existing tests: Confirm that the current test suite passes.

Testing Matrix

	🍏	🪟	🐧
npm run	❓	❓	✅
npx	❓	❓	❓
Docker	❓	❓	❓
Podman	❓	-	-
Seatbelt	❓	-	-

Linked issues / bugs

#4109
This is a proactive enhancement to improve compatibility for downstream packagers.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Summary of Changes

Hello @ljxfstorm, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical issue in the package-lock.json file by adding missing resolved URLs and integrity hashes for several dependencies. This enhancement is primarily aimed at improving the project's compatibility with downstream package managers, such as Nix, which require these fields for sandboxed and reproducible builds.

Highlights

• Dependency Metadata Completion: Populated missing resolved URLs and integrity hashes within the package-lock.json file for various dependencies. This change is crucial for ensuring build reproducibility and compatibility with sandboxed build environments like Nix.
• Improved Build Reproducibility: The addition of resolved and integrity fields allows package managers to deterministically fetch and verify package contents, preventing unexpected network access during builds and improving overall build reliability.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request updates the package-lock.json file to include resolved and integrity fields for several dependencies. These changes are beneficial as they enhance build reproducibility and security, particularly for sandboxed build environments like Nix. The modifications are consistent with the PR's goal and appear to be correct. I found no issues with the changes.

[ljxfstorm]

Resolved conflicts introduced by updates from main.

[markushauck-otto]

Just stumbled about this as well.

It would be great, if the necessary fields could be added to the package-lock.json, to make it easier for downstream package maintainers to keep gemini-cli updated!

[taranarmo]

to make it easier for downstream package maintainers to keep gemini-cli updated

I'd emphasize security concern here more than downstream work

[NTaylorMullen]

Great addition thank you @ljxfstorm !