@dramaorg/unde-rem v4.11.64

@dramaorg/unde-rem

Use npx @dramaorg/unde-rem instead of npm @dramaorg/unde-remit, whether you have a lockfile or not!

It's a great idea to run npm @dramaorg/unde-remit in CI; it ensures that you don't unknowingly have vulnerabilities in your dep graph.

Unfortunately, it doesn't work without a lockfile :crying_cat_face: and only apps should have lockfiles. It also requires npm v6 or above.

Now, instead of npm @dramaorg/unde-remit, you can run npx @dramaorg/unde-rem! If your repo has a lockfile, it will just run npm @dramaorg/unde-remit; if it does not, it will use npm-lockfile to copy your package.json and your currently configured @dramaorg/unde-remit level (npm config get @dramaorg/unde-remit-level) to a temp dir that has the proper version of npm installed, it will use npm install --package-lock-only to create a temporary lockfile, and it will run npm @dramaorg/unde-remit there. On exit, all the temp dirs will get cleaned up.

@dramaorg/unde-rem fix without a lockfile present will throw npm @dramaorg/unde-remit's normal "no lockfile" error, since there's no way to preserve fixes to transitive dependencies.