[CY-2470] How are we meant to keep our dependency versions in sync with yours?

[dwjohnston]

As I understand it:

• We have to use the exact versions of eslint dependencies that you are, and those are the versions that are maintained in this repo.

The issue I have is - how do we keep up with dependency updates?

For example, you have issues like this one: : import-js/eslint-plugin-import#1760

Where a patch update to eslint-plugin-import causes a breaking change.

You can imagine if Codacity updates this dependency and we don't then the build pipeline fails, but only on Codaciy, and we have to go through working out what's going wrong.

One possible option that we do something like add codacity-eslint and dev dependency to our project, and make sure we update it each time in the pipeline. That way we have all of the eslint plugins at whatever version in our code base? Is that purpose of this package?

The other thing I'm wondering about - what if we are using some kind of internal custom eslint plugins - then codacity wouldn't have access to those. This is simply a use case that codacity doesn't support?

[github-actions]

Internal ticket created : CY-2470

[machadoit]

This repository is a wrapper to be able to run ESLint completely isolated on Codacy side with all the dependencies installed.
We aim to have this repository updated as most as possible, and unfortunately that may cause breaking changes.

There is no easy way to guarantee the same versions at the moment, you can however consider using our CLI that will run with the same version of plugins that Codacy does (not however, that the CLI can also take some time to update, so it can also be not ideal for your use case).

Also, regarding custom eslint plugins, you are correct, they are not supported by Codacy.

We will be making some efforts in the future that can hopefully help on your use case, but unfortunately at the moment we don't have a great solution that fits perfectly on your use case.

[dwjohnston]

@machadoit Can I suggest creating a new NPM repo, something like codacy-eslint-dependencies that contains just the various ESlint/prettier/eslint plugins that are you are using here, install that as a dependency in this project?

That way we can do the same thing, and then we'd be using the same versions.

It would be mean that we would be installing a bunch of dependencies that we don't need, but given that for us they are dev dependencies only, I don't think that should matter.

I would also suggest requiring them at fixed, rather than ^versions - as, as pointed out in the eslint-plugin-import issues even patch updates can have different behavior between versions.

[machadoit]

Thanks for your suggestions! I updated the ticket internally added to community feedback so we can think about it.