Skip to content

DEPENDENCIES.md

Latest commit

 

History

History
174 lines (119 loc) · 4.62 KB

DEPENDENCIES.md

File metadata and controls

174 lines (119 loc) · 4.62 KB

Dependency Management Guide

This document provides information about the dependencies used in the News Aggregator application and how to manage them effectively.

Recent Dependency Updates

The project dependencies were recently updated to address several deprecation warnings and security concerns. The following changes were made:

Babel Plugin Updates

Deprecated Babel plugins were replaced with their modern equivalents:

Deprecated Package Replacement
@babel/plugin-proposal-private-methods @babel/plugin-transform-private-methods
@babel/plugin-proposal-class-properties @babel/plugin-transform-class-properties
@babel/plugin-proposal-numeric-separator @babel/plugin-transform-numeric-separator
@babel/plugin-proposal-nullish-coalescing-operator @babel/plugin-transform-nullish-coalescing-operator
@babel/plugin-proposal-optional-chaining @babel/plugin-transform-optional-chaining
@babel/plugin-proposal-private-property-in-object @babel/plugin-transform-private-property-in-object

These updates were necessary because the proposal plugins have been merged into the ECMAScript standard and are no longer maintained.

ESLint Updates

ESLint and related packages were updated:

Deprecated Package Replacement
eslint@8.57.1 eslint@8.57.0

Other Package Updates

Other deprecated packages were replaced with their recommended alternatives:

Deprecated Package Replacement
rollup-plugin-terser @rollup/plugin-terser
sourcemap-codec @jridgewell/sourcemap-codec
abab Native atob() and btoa()
domexception Native DOMException
w3c-hr-time Native performance.now()
workbox-google-analytics Consider GA4-compatible alternatives

Dependency Update Process

To apply these updates, an update script has been provided:

./update-dependencies.sh

This script will:

  1. Configure npm to use secure TLS
  2. Remove existing node_modules and package-lock.json
  3. Install the updated dependencies
  4. Run npm audit fix to address any remaining issues

Managing Dependencies

Adding New Dependencies

When adding new dependencies, consider the following:

  1. Check for Maintenance: Ensure the package is actively maintained
  2. Version Compatibility: Verify compatibility with Node.js 18+
  3. Security: Check for known vulnerabilities using npm audit
  4. Bundle Size: Consider the impact on application size

To add a new dependency:

npm install package-name --save

For development dependencies:

npm install package-name --save-dev

Updating Dependencies

Regular updates are recommended to address security vulnerabilities and benefit from new features:

# Update all dependencies
npm update

# Update a specific package
npm update package-name

Handling Deprecated Packages

When encountering deprecated package warnings:

  1. Check the deprecation message for recommended alternatives
  2. Update the package.json file with the recommended replacement
  3. Test thoroughly to ensure compatibility
  4. Document the change in this file

Security Considerations

TLS Configuration

Ensure npm is configured to use TLS 1.2 or higher:

npm config set registry https://registry.npmjs.org/

Vulnerability Scanning

Regularly scan for vulnerabilities:

npm audit

To fix vulnerabilities automatically:

npm audit fix

For more severe issues that require major version updates:

npm audit fix --force

Troubleshooting

Installation Issues

If you encounter issues during installation:

  1. Clean npm cache:

    npm cache clean --force

  2. Remove node_modules and package-lock.json:

    rm -rf node_modules package-lock.json
npm install

  3. Check for Node.js version compatibility:

    node -v

    Ensure you're using Node.js 18.0.0 or higher.

Dependency Conflicts

For dependency conflicts:

  1. Check the error message for specific conflict information
  2. Use the overrides field in package.json to force specific versions
  3. Consider using --legacy-peer-deps for temporary resolution: 
    npm install --legacy-peer-deps

Recommended Practices

  1. Keep dependencies up to date with regular updates
  2. Minimize the number of dependencies to reduce security risks and bundle size
  3. Document significant dependency changes in this file
  4. Test thoroughly after updates to ensure compatibility
  5. Use exact versions for critical dependencies to prevent unexpected changes