Coding standards
Security in ResourceSpace
Developer reference
Database

Managing (JS) code dependencies

From version 11 ResourceSpace is officially managing its JS dependencies using pnpm.

Installation

To install follow the pnpm's instructions (depending on your setup). Verify it's OK and then install the latest version of Node.

pnpm -v
pnpm env use --global lts

We'll use Node during the post-installation stage to run our build:dependencies script.

ResourceSpace development

Developers must use pnpm to install the all the required dependencies by running the folowing command from the ResourceSpace root directory.

pnpm install

This will read the pnpm-lock.yaml file from the current directory, resolve the dependencies and install them into the 'node_modules' directory. The lock file ensures that the same versions of packages are installed in all environments, it prevents conflicts that may arise from installing different versions of the same package resulting in a deterministic release for front-end assets.

Please note that installing dependencies this way will also provide the source maps for a lot of the libraries we have which can help you navigate easier library code in the browser should you need to debug it. Source map files are not (usually) versioned.

Library code deploy

When adding a new dependency requirement, as part of your development workflow, you have to also update the js/build_js_dependencies.js so that we copy only the necessary library code under ResourceSpace lib/.

Handling merge conflicts

Treat the lock file as generated state and regenerate it from the correctly merged package.json requirements.

  • Merge branches as needed (e.g. svn merge ^/trunk);
  • Resolve package.json first so that it contains both changes;
  • For the lock file conflict, accept their version: svn resolve --accept theirs-full pnpm-lock.yaml
  • Regenerate the lock file: pnpm install --lockfile-only
  • Inspect changes: svn diff package.json pnpm-lock.yaml

To avoid unrelated lock file diffs, it's best to try and use the same pnpm version the project expects (see packageManager in package.json)

Upgrading dependencies

If you wish to update the front-end dependencies used by ResourceSpace to their latest available versions and update the lock file use the update command.

Releases

From a sysadmin user perspective nothing will change for you. We have a custom pnpm script (build:dependencies) which will include everything needed by the front-end (e.g. copy all the relevant JS and CSS).