Dependency bump cordova-common@^3.0.0

[erisu]

Platforms affected

osx

What does this PR do?

Updates the cordova-common dependency to ^3.0.0.

What testing has been done on this change?

• Travis CI Testing: https://travis-ci.org/erisu/cordova-osx/builds/452164696

[dpogue]

Are we intentionally committing package-lock.json in this repo? If so, it might be worth deleting and regenerating it because I'm not sure the diff here is accurate...

[brodycj]

As a minor comment, I find it strange that it goes from https to http here. Looks like something that should be fixed in the npm tooling.

[dpogue]

Yeah, that's a known npm bug. It doesn't really matter because npm always uses HTTPS for fetching from the registry, but they're still trying to track down why it happens.

[erisu]

@dpogue

I recall the package-lock was regenerated, but I deleted the node_modules and package-lock.json one more time and reinstalled to create a new package-lock.json. Also has been rebased.

As for intentionally committing package-lock.json, it file was already committed so I was not deleting what was already there.

I know there is an open-ended discussion about if these files should be committed or not. As I said before, I am still in favor for committing them. But in this case, it was already committed and I only updated the existing file.

[brodycj]

Are we intentionally committing package-lock.json in this repo?

Yes, I think we reached agreement in the following discussions in the past:

• https://lists.apache.org/thread.html/7f92561d382f143aaf49e083bbe215dcf95a3f4d8b6e3cbb6089a5f3@%3Cdev.cordova.apache.org%3E
• Cordova 9 release plan cordova#10

There was some dissent, mostly from a non-member. I did raise some questions and minor concerns. I did commit package-lock.json in a few places despite my own concerns since everyone else seemed to want it. In case of any further questions or concerns I would favor discussing in the existing thread or a new issue.