Commercial product leakage to package.json
See original GitHub issueDescription of the bug
Currently commercial projects like vaadin-grid-pro
are added to the package.json and package-lock.json even tho only vaadin-core
is used as dependency.
Expected behavior
Not used dependencies / commercial products are NOT added into the package.json or package-lock.json.
Minimal reproducible example
- Create a V23 app in start.vaadin.com
- Replace
vaadin
dependency withvaadin-core
- Delete package.json & package-lock.json
- mvn
- Look at the nearly created package.json containing commercial products
Versions
- Vaadin / Flow version: V23 + V23.1.0.beta1 tested
- Java version: 11
Issue Analytics
- State:
- Created a year ago
- Reactions:3
- Comments:7 (2 by maintainers)
Top Results From Across the Web
Avoiding npm substitution attacks | The GitHub Blog
Scopes also prevent leakage that occurs if someone accidentally publishes private packages to the public npm registry.
Read more >Understanding Package-lock.Json | Javascript Tutorial
What is the package -lock. json file you see when you install dependencies in your node application? In this video, we learn all...
Read more >Package.json: dependency in a local directory? - Stack Overflow
I'm making a ton of small changes in this package and would like to be able to rerun the application after every iteration....
Read more >4 Types of Memory Leaks in JavaScript and How to Get Rid Of ...
We will also learn how to use the Chrome Development Tools to find them. Read on! Introduction. Memory leaks are a problem every...
Read more >Npm Timing Leak, Siemens Universal Key, And PHP In PNG
Use npm's API to request info on your target package, five times in a row. If the package name isn't in use, all...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
I have created this PR to generate different json file for vaadin and vaadin-core
and the json will be included into different jars.
i think flow will need to do corresponding changes to make it include the correct json into the generated package.json files.
This ticket/PR has been released with Vaadin 23.2.0.