chore(deps): add lockfile

[yoshinorin]

What does it do?

As part of security measures:

• Pin dependency versions
• Add a lockfile

Screenshots

N/A

Pull request tasks

• Add test cases for the changes.
• Passed the CI test.

[github-actions]

How to test

git clone -b chore/deps/update-and-pinned-deps https://github.com/hexojs/hexo.git
cd hexo
npm install
npm test

[github-actions]

Dependency Review

The following issues were found:

• ❌ 2 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.
• ⚠️ 157 packages with OpenSSF Scorecard issues.

View full job summary

[uiolee]

Pin dependency versions is required?

[yoshinorin]

@uiolee

Pin dependency versions is required?

I missed the library distribution perspective — pinning in package.json is unnecessary for a library. I'll revert it and keep only the lockfile.

[yoshinorin]

@uiolee

I'll revert it and keep only the lockfile.

Done :)

[SukkaW]

Try npm dedupe and npm update --depth=999 to see if we can update a few transitive deps and make CI happy?