Fix for #920 and potentially dodgy node dependencies lockfile

Author: Silic0nS0ldier

.gitignore

@@ -74,3 +74,4 @@ vagrant/Homestead/
 
 # Igore npm lockfile
 build/package-lock.json
+build/package.lock

app/sprinkles/core/src/Bakery/BuildAssets.php

@@ -89,26 +89,39 @@ protected function npmInstall($force)
         $wd = getcwd();
         chdir($this->buildPath);
 
+        // Delete troublesome package-lock.json
+        if (file_exists('package-lock.json')) unlink('package-lock.json');
+
         // Skip if lockfile indicates previous run
-        if (!$force && file_exists('package-lock.json') && filemtime('package.json') < filemtime('package-lock.json') - 1) {
+        if (!$force && file_exists('package.lock') && filemtime('package.json') < filemtime('package.lock') - 1) {
             $this->io->writeln('> <comment>Skipping as package-lock.json age indicates dependencies are already installed</comment>');
             chdir($wd);
 
             return;
         }
 
+        // Ensure extraneous dependencies are cleared out
         $exitCode = 0;
-        passthru('npm install', $exitCode);
+        passthru('npm prune');
 
-        // Ensure lockfile last-modified date is updated
-        touch('package-lock.json');
+        if ($exitCode !== 0) {
+            $this->io->error('npm dependency installation has failed');
+            exit(1);
+        }
 
-        chdir($wd);
+        // Install the new dependencies
+        $exitCode = 0;
+        passthru('npm install', $exitCode);
 
         if ($exitCode !== 0) {
             $this->io->error('npm dependency installation has failed');
             exit(1);
         }
+
+        // Update lockfile date (for skip logic)
+        touch('package.lock');
+
+        chdir($wd);
     }
 
     /**

build/.npmrc

@@ -0,0 +1 @@
+package-lock=false

build/gulpfile.esm.js

@@ -74,8 +74,9 @@ export async function assetsInstall() {
         // Install npm dependencies
         Logger("Installing vendor assets with NPM...")
 
-        // Remove package.json (package-lock.json can be left untouched as dates will invalidate it)
+        // Remove package.json and package-lock.json (if it happens to exist)
         deleteSync(vendorAssetsDir + "package.json", { force: true });
+        deleteSync(vendorAssetsDir + "package-lock.json", { force: true });
 
         // Generate package.json
         const npmTemplate = {
@@ -86,8 +87,14 @@ export async function assetsInstall() {
         const pkg = mergeNpmDeps(npmTemplate, npmPaths, vendorAssetsDir, doILog);
         Logger("Dependency collation complete.");
 
+        // Remove any existing unneeded dependencies
+        Logger("Running npm prune (using npm from PATH)");
+        execSync("npm prune", {
+            cwd: vendorAssetsDir,
+            stdio: doILog ? "inherit" : ""
+        });
+
         // Perform installation
-        // NPM will automatically remove extraneous packages (barring algorithm failure) during install
         Logger("Running npm install (using npm from PATH)");
         execSync("npm install", {
             cwd: vendorAssetsDir,