fastbootDependencies are not respected (causing failure with in-repo addons)

When building with ember-cli-fastboot@2 and @embroider/*@1.5, I’m seeing that dist/package.json includes dependencies that are not in the fastbootDependencies list in ./package.json.

While this could be problematic on its own, it also causes a build failure, because it includes in-repo addons in this list also. Because these in-repo addons are not in the npm registry (or could be totally different packages), this can:

1. break the fastboot server build
2. be a security risk(?) since an in-repo addon that is named the same as something else published to npm can get installed.

Here’s a repro where I show that an in-repo addon named with a @scope causes the fastboot server build to fail: https://github.com/mehulkar/embroider-in-repo-addons

(Reproduces with ember-cli-fastboot@3.2 as well)

[mehulkar]

That makes sense. Would it make sense not to generate a dist/package.json under embroider then? It’s already doing something different, so maybe we could be more explicit about the known good pattern? (and maybe document it somewhere in embroider if it’s a transition path other users may run into)

[ef4]

It would make sense to eventually drop the package.json. Right now there are still things fastboot reads from it.