[JIRA] (JENKINS-40407) Do we need clearer NPM dependency version synchronization across Blue Ocean HPIs and NPMs

[tom.fenne...@gmail.com (JIRA)]

Title: Message Title

Tom FENNELLY updated an issue   Jenkins / JENKINS-40407 Do we need clearer NPM dependency version synchronization across Blue Ocean HPIs and NPMs Change By: Tom FENNELLY This is more of a task to think/discuss about first. Other tasks might fall out of it. Basically, there are situations where we want to ensure that the dependency version of specific NPM packages are the same across HPIs. We actually already have a mechanism to do this (in spite of some common misconceptions ;) ) via {{js-modules}} import {{@any}}, which tells {{js-modules}} at runtime that a bundles runtime dependency can be satisfied by "any" version of that package that's already registered with {{js-modules}}. By using that + ensuring that our bootstrap bundle ({{blueocean.js}} via {{blueocean-web}} HPI) exports the versio version it uses (the "right" version) , then we can make sure all bundles use the same version of these packages. Maybe we can improve this some more. The trick here though is that this needs to be thought out and configure beforehand. We need to understand what NPM packages we need to do this with etc. We can't just do it magically or by handwaving ... we need to know exactly which packages this needs to happen for etc e.g. react, mobx, xyz etc. So, *+there will be situations where+* we are using packages and then (some time later) discover that we need to manage the dependency of that package (someone writes a plugin using the same package and things start going wrong because there are multiple/conflicting versions in play). If that happens, it's not because "the toolchain is completely broken" ... it's because there's more to using that package than was originally though and we probably need to make core changes to ensure that we "manage" the runtime loading of that package in a way that doesn't cause things to explode. *+There's no silver bullet here+* for situations like this ... we're talking about _javascript_ engines and third party libs that were never designed to run in a pugin system like we're creating (and that includes react). We're not talking about OSGi, where everything is automatically isolated from each other (which can be a big pain in the as too). Add Comment   This message was sent by Atlassian JIRA (v7.1.7#71011-sha1:2526d7c) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.