Maintaining package.json across updates

[girish]

I maintain the NodeBB package on Cloudron. It was suggested earlier that I should try to use upgrade --package option to update the package.json to the newer NodeBB version and preserving the plugin module names at the same time. This works as expected.

However, I found that --package will not remove packages that are unused. For example, in 1.13.x NodeBB had a package called json-2-csv which was removed in 1.14.x. The --package will keep the old json-2-csv in package.json even though it's now gone.

I have a few questions:

• Is this behavior intentional or should we fix --package to remove extra deps? If not, how do I remove json-2-csv from package.json? Of course, I can npm uninstall the modules which are now gone in the newer NodeBB version manually but this means I have to manually diff package.json for every NodeBB upgrade (the situation I was trying to avoid in my first post). Having stale things in package.json is harmless but the issue is NodeBB does a dep check on startup (and json-2-csv is not installed).
• A related issue: I found the flag dep-check to skip the dep check on start up. However, the loader does not pass command line args to app (so, you cannot use --no-dep-check). This means you have to use env var but that doesn't work because nconf parses dep-check=false as a string instead of bool (issue) and the code in start.js compares a string against a boolean now. Effectively, I don't know how to pass no-dep-check via loader.js.

Thanks!

[PitaJ]

@girish said in Maintaining package.json across updates:

Is this behavior intentional or should we fix --package to remove extra deps?

This should be fixed. Can you open an issue on GitHub? I think it should be possible to only merge forward packages starting with nodebb- (nodebb-theme-*, nodebb-plugin-, etc)

If not, how do I remove json-2-csv from package.json? Of course, I can npm uninstall the modules which are now gone in the newer NodeBB version manually but this means I have to manually diff package.json for every NodeBB upgrade (the situation I was trying to avoid in my first post).

If you wish to do this manually, I'd suggest you instead just copy install/package.json to package.json and then run npm install [packages...] for any plugins you need. Active plugins listed under ./nodebb plugins

Having stale things in package.json is harmless but the issue is NodeBB does a dep check on startup (and json-2-csv is not installed).

If it's in package.json, it should be installed. In what cases would there be a package specified as a dependency in package.json but that package not be installed? Uninstalling a package via npm should remove that package from the dependencies. This is the case in any recent version of npm.

A related issue: I found the flag dep-check to skip the dep check on start up. ... Effectively, I don't know how to pass no-dep-check via loader.js.

You should be able to set "dep-check": false in config.json

[julian]

@PitaJ @girish thanks for pointing out the issues with package.json and upgrades. The solution to remove packages if not present in install/package.json (except those beginning with nodebb- should resolve the situation

If you could open up an issue so we can track this, that'd be helpful thanks!

[girish]

@julian @PitaJ Thanks for the quick response. I will open a GitHub issue.

[girish]

I created https://github.com/NodeBB/NodeBB/issues/8547