alleyinteractive / alleyinteractive/create-wordpress-project

Migrate Dependency Extraction Webpack Plugin-Mapped Dependencies to devDependencies

Aperta
#209 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
PHP
Stelle
9
Fork
3
Merge medio
2g 20h
PR unite (30g)
4

Descrizione

### Description

All `@wordpress/*` packages plus `react` and `react-dom` should be moved to devDependencies. Rationale: we pin the versions of these packages to the versions that are bundled with the version of WordPress that we are using, and in the build process, they don't actually get compiled - they get remapped to the `wp` global. If one of them (or one of their dependencies) gets flagged in an npm audit, we can't actually update the package (both because the package wouldn't actually be updated, since it's provided by WordPress, and because we would then have a mismatch between the version we're using locally and what's actually running in production). Since npm audit only runs against production dependencies and not devDependencies, we should move these packages to devDependencies. This should not cause an issue in our ESLint setup because we are already disabling the `import/no-extraneous-dependencies` rule, which would otherwise flag the move as being a problem.

### Use Case

When a user uses this framework, they should not have `npm audit` findings reported on packages that are supplied by the WordPress installation.

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.