To try & get deps without vulns in them.
Exceptions are:
* electron builder: which is nontrivial to update
* webpack-dev-server: probably needs newer webpack
* moderizr: no new version released yet
so karma-webpack 3.0.5 is 4x slower than 4.0.0-beta.0 for webpacking for unknown reasons.
However, 4.0.0-rc.1 and 4.0.0-rc.2 fail with a different error. So: pinned for now
If we don't block on SDK builds, then the riot-web build fails due to half-built dependencies. This needs to be done at two levels: the js-sdk because it is used by both the react-sdk and riot-web, and at the react-sdk because riot-web needs it. This means our build process is synchronous for js -> react -> riot, at least for the initial build.
This does increase the startup time, particularly because the file watch timer is at 5 seconds. The timer is used to detect a storm of file changes in the underlying SDKs and give the build process some room to compile larger files if needed.
The file watcher is accompanied by a "canary signal file" to prevent the build-blocking script from unblocking too early. Both the js and react SDKs build when `npm install` is run, so we ensure that we only listen for the `npm start` build for each SDK.
This is all done at the riot level instead of at the individual SDK levels (where we could use a canary file to signal up the stack) because:
* babel (used by the js-sdk) doesn't really provide an "end up build" signal
* webpack is a bit of a nightmare to get it to behave at times
* this blocking approach is really only applicable to riot-web, although may be useful to some other projects.
Hopefully that all makes sense.
A step towards a real solution for https://github.com/vector-im/riot-web/issues/7305
This approach makes use of `npm link` to remove the use of symlinks in the build process. The build process has also been altered to invoke the build process of each underlying SDK (react, js). This means that one can now `npm link` and `npm start` and have a working environment.
At the same time, parallelshell was dropped due to lack of maintenance from the maintainer.
As per https://github.com/vector-im/riot-web/issues/7083
The package-lock file is currently not bringing any of the benefits
it's supposed to bring because we don't do the neccessary things to
massage it during the release process. Remove it until we actually
manage it correctly.
David Baker