GN-4543: Fix/enable dependency-lint

[dkozickis]

Overview

GN-4542: Fix issues reported by dependency-lint

• Pin tracked-toolbox to ^2.0.0 based on this comment - Update dependencies appuniversum/ember-appuniversum#421 (comment)
• Pin ember-focus-trap to 1.0.1 based on this issue - Peerdep on ember-source too strict? josemarluedke/ember-focus-trap#82

GN-4542: Enable dependency-lint on CI

Connected issues and PRs:

https://binnenland.atlassian.net/browse/GN-4543

Setup

1. Checkout

How to test/reproduce

1. Run ember dependency-lint, should return 0

Checks PR readiness

• UI: works on smaller screen sizes
• UI: feedback for any loading/error states
• Check cancel/go-back flows
• Check database state correct when deleting/updating (especially regarding relationships)
• changelog
• npm lint
• no new deprecations

[elpoelma]

Seems like a good solution and the dependency-lint issues are resolved.
There is something I do not understand though:

• ember-rdfa-editor specifies ~1.0.1 for the ember-focus-trap dependency, so accepts 1.0.1 and 1.0.2
• appuniversum specifies ^1.0.2 for the ember-focus-trap dependency, so accepts 1.0.2 and 1.1.0 where 1.1.0 is faulty.
  => Why doesn't npm dedupe the dependency and install 1.0.2 once?

[dkozickis]

Good question, I don't know 🤔 I've bumped appuniversum yesterday, and it picked 1.1.0 as dependency. I've tried to reinstall it now and it still picks 1.1.0. I am afraid to go down the rabbit hole of resolutions :D

[piemonkey]

Hmm, I wonder if using npm install --prefer-dedupe should be the default for any Ember apps and whether it would help here. Unfortunately it doesn't look like we can specify it in package.json, it would be fixed in the lockfile, but someone running npm i without the flag might get local changes. Actually, maybe it would make sense to add npm dedup as a post install script?

[dkozickis]

Thanks! Did not know about --prefer-dedupe and npm dedupe

Although, using

npm uninstall @appuniversum/ember-appuniversum && npm install @appuniversum/[email protected] --save-dev --prefer-dedupe

still brings [email protected] for @appunivesrum 🤔

P.S. I guess it does not do one off dedupe for a package, but only does a full dedupe, trying with npm dedupe now, and it actually deduped ember-focus-trap

❯ npm ls ember-focus-trap
[email protected] /Users/denis/code/flem/frontend-embeddable-notule-editor
├─┬ @appuniversum/[email protected]
│ └── [email protected]
└─┬ @lblod/[email protected]
  └── [email protected] deduped

it did dedupe the whole package.json though, so there are multiple changes in package-lock.json 😅

[elpoelma]

Thanks! Did not know about --prefer-dedupe and npm dedupe

Although, using

npm uninstall @appuniversum/ember-appuniversum && npm install @appuniversum/[email protected] --save-dev --prefer-dedupe

still brings [email protected] for @appunivesrum 🤔

P.S. I guess it does not do one off dedupe for a package, but only does a full dedupe, trying with npm dedupe now, and it actually deduped ember-focus-trap

❯ npm ls ember-focus-trap
[email protected] /Users/denis/code/flem/frontend-embeddable-notule-editor
├─┬ @appuniversum/[email protected]
│ └── [email protected]
└─┬ @lblod/[email protected]
  └── [email protected] deduped

it did dedupe the whole package.json though, so there are multiple changes in package-lock.json 😅

Ok nice :) I don't think it's a problem that there are other changes in the package-lock

[piemonkey]

Hmm, as I feared, running npm i gives me changes to the package-lock.json. I tried adding a postinstall but npm dedupe is way too slow to be practical. Actually, the changes to package-lock.json were just some packages losing the "dev": true flag for some reason... Still npm dedupe is definitely too slow to be used in a postinstall, so we shouldn't go down that route.

[elpoelma]

I guess we can indeed leave the override on ~1.0.1 for now, with the ember 4 upgrade we'll be able to go to 1.1 without issues.

[elpoelma]

I just set the override to ~1.0.1 (which is somewhat less restrictive) and updated ember-focus-trap to 1.0.2 in the package-lock (which contains some fixes)

[abeforgit]

@dkozickis just needs a merge from latest master and then its good to go