Regenerate tutor-finder package-lock.json so npm ci works

[Hotragn]

Fixes #251.

The bug

npm ci fails in tutor-finder on current main:

$ cd tutor-finder && npm ci
npm error code EUSAGE
npm error `npm ci` can only install packages when your package.json and
npm error package-lock.json or npm-shrinkwrap.json are in sync.
npm error Missing: @radix-ui/react-label@2.1.15 from lock file
npm error Missing: @radix-ui/react-separator@1.1.15 from lock file
npm error Missing: @radix-ui/react-toggle@1.1.18 from lock file
npm error Missing: @radix-ui/react-tooltip@1.2.16 from lock file
npm error Missing: @radix-ui/react-primitive@2.1.10 from lock file
...

Four declared dependencies were added without regenerating the lock. npm install papers over it by re-resolving, which is presumably why it went unnoticed — but that's also the problem:

• The reproducible install path is broken. Anyone following a scripted setup, or any CI using npm ci, hits a hard failure rather than a warning.
• The committed lock doesn't describe the tree you actually get, which defeats the point of committing one.
• OSV-Scanner reads the lock, so those four subtrees and their transitives are outside what the repo's own vulnerability scanning can see.

The fix

npm install --package-lock-only. No package.json change, no source change — the entire diff is the lockfile: 48 package entries added, all four dependencies plus their transitive closure (mostly @radix-ui/* internals and @floating-ui/*).

Yes, it's a big diff. That's the expected shape for a lock regeneration, and it's exactly why I kept it out of #250 rather than burying a lint repair under 800 lines of lockfile.

Verification

cd tutor-finder
npm install --package-lock-only

Three checks, since a lock can be closer without being correct:

1. Completeness — every dependency declared in package.json now resolves to an entry in the lock tree (previously 4 were absent).
2. Root match — the lock's root dependencies / devDependencies match package.json exactly.
3. Stability — re-running the regeneration produces a byte-identical file, so the lock is settled rather than merely improved.

Scope

I checked the other five recipes from #248 — restaurant-comparison-tool, scholarship-finder, summer-school-finder, tenders-finder and stay-scout-hub are all in sync. tutor-finder was the only one affected among those.

I have not audited the remaining ~28 recipes, so there may be more of these. Happy to run that sweep and report if it's useful — it's mechanical, and probably worth knowing given the OSV-Scanner angle.

Independent of #249 and #250; touches only this one file.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b2de533b-fcec-468f-a5e4-1276395cb153

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Hotragn]

Follow-up: verified end to end with a clean install rather than just the sync check.

cd tutor-finder && rm -rf node_modules && npm ci
# exit 0

Before this change the same command fails immediately with EUSAGE and the four Missing: lines above, so that's the whole behaviour change: npm ci goes from a hard failure to a clean install.