Graylog2 / Graylog2/graylog2-server
Remove `react`/`react-dom` from `graylog-web-plugin`, replace with `peerDependency`
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
The `graylog-web-plugin` is including commonly used packages (like `react`, `react-dom`, ...) that we want to use consistent versions for and installs them as transitive dependencies. This works, but merely by accident. The goals of this were:
* To ensure that only a single React copy is present. This is not needed, as it is taken care of by the webpack build including React in the vendor bundle and linking all imports against it.
* To ensure that core & plugins are using the same react version. This is not strictly required, as long as the React version included in core is compatible with the one the plugin is built against.
The downsides of the current approach are:
1. It works by exploiting the habit of yarn/npm (in the current versions) to flatten the dependency tree. This might change and it might introduce subtle bugs before it is detected.
2. We get a lot of peer dependency warnings when doing a `yarn install`. Transitive dependencies don't know that React is installed through another transitive dependency, so errors are raised about it missing. Other errors might get lost due to this.
3. Still no react-compatibility is ensured. A plugin might be built against version A and loaded in a server with version B. If version B contains a change that is breaking specific usage from version A, the plugin will not work.
To address 1. & 2., I would suggest that we do include `react`/`react-dom` packages in explicitly in every bundle (core & plugins) and maintain a version compatibility rule in `graylog-web-plugin` by defining a version range as `peerDependency`. This reduces error messages in general and produces one if a plugin is building against a `graylog-web-plugin` version that expects a different React version than the plugin version.
The suggested roadmap for this is:
1. (3.3) Explicitly add `react`/`react-dom` to the `package.json` of core. Plugins will still get it installed through `graylog-web-plugin`
2. (3.3) Add a `peerDependency` clause in `graylog-web-plugin`.
3. (3.3) Add a section to the upgrade notes telling about the deprecation of the transitive dependency and that `react`/`react-dom` will be removed from `graylog-web-plugin`.
4. (3.3) Add `react`/`react-dom` to the `package.json` of all of our plugins
5. (3.4) Remove `react`/`react-dom` from `graylog-web-plugin`.
Contributor guide
Assessment
This issue has not been assessed yet.