Is `kotlin-js-store` meant to be checked in to the...

# webassembly

[deanalvero]

Is kotlin-js-store meant to be checked in to the repo? Or, do I put it in .gitignore?

[Chrimaeon]

a simple Google search would have given you:

https://kotlinlang.org/docs/js-project-setup.html#version-locking-via-kotlin-js-store

To follow a recommended practice, commit kotlin-js-store and its contents to your version control system. It ensures that your application is being built with the exact same dependency tree on all machines.

Glad to be your personal search engine though 😉

[Adam Semenenko]

It's very important to commit the lock files, for two reasons.

Freezing the resolved dependencies in a lock file is required for build reproducibility. It's common for npm dependencies to use version ranges. Therefore, the graph of a project's resolved dependencies (direct and transitive) is not stable. The graph can change whenever a new version of any dependency is released - which (theoretically) can cause hard-to-track-down bugs.

Another benefit lock files is it limits the effects of attacks on npm packages. Without lock files, npm will automatically fetch the latest patch version of a dependency, which could be malicious. With lock files, the exact version is frozen until you choose to update. The lock files can also be scanned automatically by tools like Dependabot or Renovate, which can check there's no vulnerable version.

However, the UX of lock files in KGP is not great. We are looking at improving it. Feedback is welcome!
https://youtrack.jetbrains.com/issue/KT-84782/Improve-UX-when-working-with-JS-and-WasmJS-lock-files-in-KGP

[Winson Chiu]

Are the lock files all that are required for reproducible Kotlin JS/Wasm builds? Or does stuff like platform filesystem, JDK, etc. matter as well?

I'm trying to get fully reproducible builds between my desktop and laptop for my site and last I tried I saw some naming/formatting differences in the final JS files.

[Adam Semenenko]

@Winson Chiu That sounds unexpected. Please start a new thread in #CDFP59223 :)

[Winson Chiu]

Actually I re-ran the build today and it's only JS that differs. Specifically it's just the order of 2 SendChannel and ReceiveChannel declarations are reversed. Out this week but I can start a thread in #C0B8L3U69 when I get back.