DP-8334: Use NPM instead of Bower to pull in front end dependencies #502
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR removes switches from using Bower to NPM for dependencies in Mayflower Patternlab. The motivation for doing this is that Bower is deprecated (see https://bower.io/), and Github does not do scanning of Bower dependencies for security vulnerabilities. I tried to keep versions as close as I could, but in some cases I wasn't able to maintain the version or we needed to switch to a completely different package. Things that are different:
core-js
(for ES level polyfills), andmdn-polyfills
(for browser level polyfills). These should be comparable, because of the nature of polyfills.0.10.5
to1.13.2
, although this isn't actually as extreme as it seems, sincetwigjs-bower
used Twig1.10.4
.Additionally, at the end of this work, I ran
npm audit
to fix known vulnerabilities. I believe the only things that were updated were build related (lots ofminimatch
updates).The overall effect of this PR is that it increases our vendor JS size from 332K to 396K, which I consider an acceptable tradeoff for now. We could reduce this further in the future by fully removing Handlebars (~100k, which we're barely using), and by splitting off the polyfills into a file that's only loaded for older browsers (50k).
Related Issue / Ticket
Steps to Test
Screenshots
Use something like licecap to capture gifs to demonstrate behaviors.
Additional Notes:
Anything else to add?
Impacted Areas in Application
@todo
Today I learned...