Dependency security & reproducible builds
RAIQL 0.17 hardens generated dependency handling without pretending upstream software can never receive a new advisory.
Exact dependency declarations
Generated package.json files use exact versions rather than caret or tilde ranges. This prevents a regeneration performed tomorrow from silently selecting a different dependency tree.
"next": "16.3.8"
"react": "19.2.0"
"@prisma/client": "7.10.0"Create the lock
raiql generate
raiql lockraiql lock creates package-lock.json without running dependency lifecycle scripts and writes raiql.dependencies.lock.json containing the lockfile SHA-256.
Audit before release
raiql audit
raiql audit --productionThe command rejects floating dependency declarations and runs npm audit with a high-severity failure threshold. Production mode omits development dependencies.
Reproducible installation
When a generated lockfile exists, RAIQL development/build workflows prefer npm ci. Without one they fall back to npm install. Docker generation follows the same rule.
Security baseline
Generated projects include raiql.security.json, SECURITY.md and an npm configuration requiring exact saves and Node 22.x. RAIQL 0.17 keeps Prisma on the supported 7.10 line and pins Next.js to the reviewed 16.3.8 baseline.
Upstream advisories
A pinned dependency is reproducible, not permanently safe. Run raiql audit in CI and before releases, and update the RAIQL security baseline when upstream security releases become available.