question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Commercial product leakage to package.json

See original GitHub issue

Description of the bug

Currently commercial projects like vaadin-grid-pro are added to the package.json and package-lock.json even tho only vaadin-core is used as dependency.

Expected behavior

Not used dependencies / commercial products are NOT added into the package.json or package-lock.json.

Minimal reproducible example

  • Create a V23 app in start.vaadin.com
  • Replace vaadin dependency with vaadin-core
  • Delete package.json & package-lock.json
  • mvn
  • Look at the nearly created package.json containing commercial products

Versions

  • Vaadin / Flow version: V23 + V23.1.0.beta1 tested
  • Java version: 11

Issue Analytics

  • State:closed
  • Created a year ago
  • Reactions:3
  • Comments:7 (2 by maintainers)

github_iconTop GitHub Comments

1reaction
ZheSun88commented, Jun 20, 2022

I have created this PR to generate different json file for vaadin and vaadin-core

and the json will be included into different jars.

Platform includes free components into vaadin-core-versions.json and includes it into vaadin-core JAR
Platform includes commertial components into vaadin-versions.json and includes it into vaadin JAR

i think flow will need to do corresponding changes to make it include the correct json into the generated package.json files.

0reactions
vaadin-botcommented, Sep 7, 2022

This ticket/PR has been released with Vaadin 23.2.0.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Avoiding npm substitution attacks | The GitHub Blog
Scopes also prevent leakage that occurs if someone accidentally publishes private packages to the public npm registry.
Read more >
Understanding Package-lock.Json | Javascript Tutorial
What is the package -lock. json file you see when you install dependencies in your node application? In this video, we learn all...
Read more >
Package.json: dependency in a local directory? - Stack Overflow
I'm making a ton of small changes in this package and would like to be able to rerun the application after every iteration....
Read more >
4 Types of Memory Leaks in JavaScript and How to Get Rid Of ...
We will also learn how to use the Chrome Development Tools to find them. Read on! Introduction. Memory leaks are a problem every...
Read more >
Npm Timing Leak, Siemens Universal Key, And PHP In PNG
Use npm's API to request info on your target package, five times in a row. If the package name isn't in use, all...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found