alleyinteractive / alleyinteractive/create-wordpress-project

Migrate Dependency Extraction Webpack Plugin-Mapped Dependencies to devDependencies

未关闭
#209 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
PHP
星标
9
派生
3
平均合并
2 天 20 小时
30 天内合并 PR
4

描述

### Description

All `@wordpress/*` packages plus `react` and `react-dom` should be moved to devDependencies. Rationale: we pin the versions of these packages to the versions that are bundled with the version of WordPress that we are using, and in the build process, they don't actually get compiled - they get remapped to the `wp` global. If one of them (or one of their dependencies) gets flagged in an npm audit, we can't actually update the package (both because the package wouldn't actually be updated, since it's provided by WordPress, and because we would then have a mismatch between the version we're using locally and what's actually running in production). Since npm audit only runs against production dependencies and not devDependencies, we should move these packages to devDependencies. This should not cause an issue in our ESLint setup because we are already disabling the `import/no-extraneous-dependencies` rule, which would otherwise flag the move as being a problem.

### Use Case

When a user uses this framework, they should not have `npm audit` findings reported on packages that are supplied by the WordPress installation.

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。