feat(cli): add lb4 update command to check/update project dependencies

[raymondfeng]

Adding lb4 version for https://loopback.io/doc/en/lb4/Command-line-interface.html#upgrading-loopback-dependencies:

• lb4 update runs against a LB4 project and checks dependencies against the installed @loopback/cli.
• By default, lb4 update checks for exact match. Use --semver option to check compatibility using semver semantics.

Checklist

👉 Read and sign the CLA (Contributor License Agreement) 👈

• npm test passes on your machine
• New tests added or existing tests modified to cover all changes
• Code conforms with the style guide
• API Documentation in code was updated
• Documentation in /docs/site was updated
• Affected artifact templates in packages/cli were updated
• Affected example projects in examples/* were updated

👉 Check out how to submit a PR 👈

[MarkOfSine]

@raymondfeng this will be useful feature.
I would suggest an enhancement to include version checking of typescript. i.e. in particular noting where certain features are not yet compatible with a particular version of typescript.
Mainly forward looking (i.e. latest or more current versions of Typescript)

[raymondfeng]

@MarkOfSine Thank you for chiming in.

I would suggest an enhancement to include version checking of typescript. i.e. in particular noting where certain features are not yet compatible with a particular version of typescript.
Mainly forward looking (i.e. latest or more current versions of Typescript)

The version of typescript is part of CLI template for dependencies too. As a result. lb4 version checks typescript. But we don't have enough knowledge to tell if it's fine to upgrade to latest version TypeScript though. Our experience is that it's usually safe to stay within patch versions, but often breaking with new minor. For example ~3.6.4 is good while ^3.6.4 is risky.

[bajtos]

👇

[bajtos]

I find the name version problematic, it does not communicate the fact that it can be used to update dependencies. We already have lb4 --version to print the version of LoopBack dependencies installed in the project.

I am proposing:

(1)
Improve lb4 --version to include information about packages that are outdated. At the moment, we print output like this:

$ lb4 --version
@loopback/cli version: 1.24.0

@loopback/* dependencies:
  - @loopback/authentication: ^3.2.1
  - @loopback/boot: ^1.5.10
...

I am proposing to add a short text after each outdated version, possibly highlighted using chalk.red:

$ lb4 --version
@loopback/cli version: 1.24.0

@loopback/* dependencies:
  - @loopback/authentication: ^3.0.1 (outdated)
  - @loopback/boot: ^1.5.10

(2)
Rename the new command to something like lb4 update or lb4 update-deps. Personally, I prefer lb4 update, because it's short and in line with npm update command that most developers are hopefully familiar with.

This opens a question though - what is the benefit of this LB-specific update command when compared to npm update? Why (or when?) should our users use this new command instead of npm update?

[bajtos]

What is the benefit of this LB-specific update command when compared to npm update? Why (or when?) should our users use this new command instead of npm update?

It would be awesome if lb4 update could run scripts to automatically apply changes necessary to migrate the codebase to newer conventions. That would be a perfect explanation why to run lb4 update instead of npm update.

[raymondfeng]

I'm good to have lb4 update. The key benefit of lb4 update over npm update is that lb4 update honors the collection of compatible LB4 packages that released with the current lb4 command from @loopback/cli.

[raymondfeng]

Please --version is implemented at cli.js level without a yeoman generator.

[raymondfeng]

@bajtos I have refactored the code to use lb4 update.

[emonddr]

Cool feature.

[bajtos]

Reviewed at high level, will review implementation details next week.

[raymondfeng]

@bajtos PTAL.

[bajtos]

I don't see any blocking problems, but please consider my comments below.

I am approving this PR to not block the progress, please get at least one person to approve the final patch before landing.