From mboxrd@z Thu Jan 1 00:00:00 1970 From: swedebugia Subject: Re: Cyclic npm dependencies Date: Sun, 25 Nov 2018 14:16:36 +0100 Message-ID: <4c3d31c1-de55-68a6-ee65-5cc3d09356f9@riseup.net> References: Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:48039) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gQuBQ-0001M4-Am for guix-devel@gnu.org; Sun, 25 Nov 2018 08:10:45 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gQuBM-0004j8-Da for guix-devel@gnu.org; Sun, 25 Nov 2018 08:10:44 -0500 Received: from mx1.riseup.net ([198.252.153.129]:43323) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gQuBM-0004gI-7E for guix-devel@gnu.org; Sun, 25 Nov 2018 08:10:40 -0500 In-Reply-To: Content-Language: en-US List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Jelle Licht Cc: guix-devel On 2018-11-24 16:41, Jelle Licht wrote: > Hey swedebugia, >=20 > I will still send a more elaborate reply to the general npm-importer > thread later this week, but we can assume that generally these > recursive dependencies can be untangled by looking at the different > versions of the dependencies. >=20 > So in your example, I imagine an input chain like: > node-glob 0.1=C2=A0 -> node-rimraf 0.1 -> node-glob 0.2 -> node-rimraf = 0.2 ->=20 > .... -> node-glob 1.0 -> node-rimraf 1.0 Thank you for showing me a way forward. I did not think of this :p >=20 > While *extremely* annoying to untangle, this is definitely doable. > Problems arise if this chain does not actually exist, which basically > means that we have to hunt down commits [1] which are steps in these > chains. Another complication is the versioning scheme used by many npm > packages, the semver [2] + ranges notation [3]. This makes this kind of > 'versioning archeology' even harder to do. >=20 > For the case where this chain does exist, I have been working on a > semi-npm-compatible semver parser for guile [4], which I was hoping to > integrate in the npm importer or a standalone tool to assist people > wanting to untangle these dependency chains. The goal would be to > reconstruct the needed versions to package by parsing data in the > package.json files of historic versions of these packages. Sounds good with a dedicated tool. For now I concluded: jquery, browserify, async are off limits because of one or more cycdeps. Right now I am pursuing rollup and leaflet. I put all cycdeps aside and intend to publish here in a thread for brave=20 hackers to work on. ;-) --=20 Cheers Swedebugia