Projects get broken for no good reason

When updating the platform version in pom.xml file, I expect the project to keep on working without any additional changes, instead of causing errors in the client side and forcing me to remove files I have no idea about

When some frontend dependency has updated, I don’t want it to automatically break my project, but instead keep things working as is and maybe provide me the information that I might want to update things

Related to issues like vaadin/beverage-starter-flow#383, vaadin/bookstore-starter-flow#152 and vaadin/skeleton-starter-flow#192.

Related slack threads:

• https://vaadin.slack.com/archives/C6RAXJATF/p1561451299172400
• https://vaadin.slack.com/archives/C6RAXJATF/p1561440435160000
• https://vaadin.slack.com/archives/C6RAXJATF/p1561450281166600

[caalador]

Note on investigation step 4. npm ci states ci can only install packages with an existing package-lock.json or npm-shrinkwrap.json This means that in the case where package-lock.json doesn’t exist we should run npm install for the first installation round to get the package-lock.json file. and onlu it the pacage-lock exists should we run npm ci

[manolo]

Technical details about implementation decided.

Considerations

• There is the file target/frontend/package.json which is updated each time a new dependency is added or removed or the version changes
• In the file target/frontend/package.json there is an entry for the "@vaadin/vaadin-core-shrinkwrap": "14.0.0-rc1" whose version meets the platform one
• In the node_modules/@vaadin/flow-deps/package.json we have the same content thatn in the target/frontend/package.json
• The shrinkwrap version should be also in the package-lock.json file

Implementation

• When we detect a change in the shrink-wrap version we should delete rm -rf package-lock.json node_modules target/frontend/node_modules
• How to detect the shrink-wrap version would need to visit package-lock.json, node_modules/@vaadin/flow-deps/package.json and target/frontend/package.json

References

• How to read a *.json and get its JsonObject representation https://github.com/vaadin/flow/blob/master/flow-server/src/main/java/com/vaadin/flow/server/frontend/NodeUpdater.java#L182 it should work for parsing the package-lock.json file, for the others there should be already a method using this.
• How to know that a dependency needs to be added because of missing or changed https://github.com/vaadin/flow/blob/master/flow-server/src/main/java/com/vaadin/flow/server/frontend/NodeUpdater.java#L219 it can be used as reference about something has changed
• The point where shrink-wrap dependency is added is in https://github.com/vaadin/flow/blob/master/flow-server/src/main/java/com/vaadin/flow/server/frontend/TaskUpdatePackages.java#L71 here we should check for the new version of the platform and take the decision to remove