fix(deps): fix batch of missing production dependencies v2.0.0-rc.1 #3345

petermetz · 2024-06-21T01:26:48Z

Huge diff, simple changes:

Where applicable, I added import type {..} instead of import {...}
so that we do not need the dependency in the production dependencies.
For imports where the code imported was actually used at runtime I
altered the package.json file so that the dependency is marked as a production
dependency and therefore won't crash anymore when being imported in isolation
(e.g. outside of the mono-repo dev build).

Fixes #3344

Signed-off-by: Peter Somogyvari peter.somogyvari@accenture.com

Pull Request Requirements

Rebased onto upstream/main branch and squashed into single commit to help maintainers review it more efficient and to avoid spaghetti git commit graphs that obfuscate which commit did exactly what change, when and, why.
Have git sign off at the end of commit message to avoid being marked red. You can add -s flag when using git commit command. You may refer to this link for more information.
Follow the Commit Linting specification. You may refer to this link for more information.

Character Limit

Pull Request Title and Commit Subject must not exceed 72 characters (including spaces and special characters).
Commit Message per line must not exceed 80 characters (including spaces and special characters).

A Must Read for Beginners
For rebasing and squashing, here's a must read guide for beginners.

1. The depcheck tool we use have not correctly discovered some of the missing dependencies that we have because it only verifies that the imported dependency is present SOMEwhere in the package.json file, not that it is specifically present in the production dependencies section which leads to crashes and broken packages due to the API server not installing dev dependencies when instantiating a plugin and therefore missing a few of the dependencies that are otherwise very much needed at runtime in production. 2. The solution to the problem was to implement our own typescript parsing with babel and then double check the work of depcheck to make sure that the dependencies that it marks as "no issues" are actually OK and have no issues. 3. The hardest edge case was type imports e.g. `import type { Express } from "express";` because the import was there, but we did not actually need that dependency in the production dependencies as long as ALL of the imports to it in the given package were type imports. To robustly verify this being the case or not we had to pull out the big guns and parse all the typescript code per package to make sure that we've looked at every single import of the dependency in question at every single code file of the package in question. Depends on hyperledger-cacti#3345 Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>

Huge diff, simple changes: 1. Where applicable, I added `import type {..}` instead of `import {...}` so that we do not need the dependency in the production dependencies. 2. For imports where the code imported was actually used at runtime I altered the package.json file so that the dependency is marked as a production dependency and therefore won't crash anymore when being imported in isolation (e.g. outside of the mono-repo dev build). Fixes hyperledger-cacti#3344 Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>

1. The depcheck tool we use have not correctly discovered some of the missing dependencies that we have because it only verifies that the imported dependency is present SOMEwhere in the package.json file, not that it is specifically present in the production dependencies section which leads to crashes and broken packages due to the API server not installing dev dependencies when instantiating a plugin and therefore missing a few of the dependencies that are otherwise very much needed at runtime in production. 2. The solution to the problem was to implement our own typescript parsing with babel and then double check the work of depcheck to make sure that the dependencies that it marks as "no issues" are actually OK and have no issues. 3. The hardest edge case was type imports e.g. `import type { Express } from "express";` because the import was there, but we did not actually need that dependency in the production dependencies as long as ALL of the imports to it in the given package were type imports. To robustly verify this being the case or not we had to pull out the big guns and parse all the typescript code per package to make sure that we've looked at every single import of the dependency in question at every single code file of the package in question. Depends on hyperledger-cacti#3345 Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>

1. The depcheck tool we use have not correctly discovered some of the missing dependencies that we have because it only verifies that the imported dependency is present SOMEwhere in the package.json file, not that it is specifically present in the production dependencies section which leads to crashes and broken packages due to the API server not installing dev dependencies when instantiating a plugin and therefore missing a few of the dependencies that are otherwise very much needed at runtime in production. 2. The solution to the problem was to implement our own typescript parsing with babel and then double check the work of depcheck to make sure that the dependencies that it marks as "no issues" are actually OK and have no issues. 3. The hardest edge case was type imports e.g. `import type { Express } from "express";` because the import was there, but we did not actually need that dependency in the production dependencies as long as ALL of the imports to it in the given package were type imports. To robustly verify this being the case or not we had to pull out the big guns and parse all the typescript code per package to make sure that we've looked at every single import of the dependency in question at every single code file of the package in question. Depends on #3345 Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>

1. The depcheck tool we use have not correctly discovered some of the missing dependencies that we have because it only verifies that the imported dependency is present SOMEwhere in the package.json file, not that it is specifically present in the production dependencies section which leads to crashes and broken packages due to the API server not installing dev dependencies when instantiating a plugin and therefore missing a few of the dependencies that are otherwise very much needed at runtime in production. 2. The solution to the problem was to implement our own typescript parsing with babel and then double check the work of depcheck to make sure that the dependencies that it marks as "no issues" are actually OK and have no issues. 3. The hardest edge case was type imports e.g. `import type { Express } from "express";` because the import was there, but we did not actually need that dependency in the production dependencies as long as ALL of the imports to it in the given package were type imports. To robustly verify this being the case or not we had to pull out the big guns and parse all the typescript code per package to make sure that we've looked at every single import of the dependency in question at every single code file of the package in question. Depends on hyperledger-cacti#3345 Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>

petermetz requested review from takeutak, izuru0, jagpreetsinghsasan, VRamakrishna, sandeepnRES and outSH as code owners June 21, 2024 01:26

petermetz enabled auto-merge (rebase) June 21, 2024 01:26

petermetz mentioned this pull request Jun 21, 2024

ci(custom-checks): fix depcheck not detecting missing dependencies #3346

Merged

5 tasks

petermetz requested a review from RafaelAPB June 21, 2024 01:28

outSH approved these changes Jun 21, 2024

View reviewed changes

sandeepnRES approved these changes Jun 24, 2024

View reviewed changes

petermetz force-pushed the fix-missing-production-dependencies-issue-3344 branch from b5ebd12 to cc11009 Compare June 24, 2024 07:02

petermetz merged commit 51d64ee into hyperledger-cacti:main Jun 24, 2024
139 of 150 checks passed

petermetz deleted the fix-missing-production-dependencies-issue-3344 branch June 24, 2024 07:34

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): fix batch of missing production dependencies v2.0.0-rc.1 #3345

fix(deps): fix batch of missing production dependencies v2.0.0-rc.1 #3345

petermetz commented Jun 21, 2024

fix(deps): fix batch of missing production dependencies v2.0.0-rc.1 #3345

fix(deps): fix batch of missing production dependencies v2.0.0-rc.1 #3345

Conversation

petermetz commented Jun 21, 2024