Update all JavaScript dependencies which cause no changes

The cspell issue was committed so this needs some work.

spokje → changed the visibility of the branch 11.x to hidden.

Rebased

Applied locally for about 20 minutes while doing other stuff and nothing seemed off. Wasn't sure how else to test.

LGTM

Committed/pushed to 11.x and cherry-picked to 11.1.x, thanks!

Should do the equivalent update for 10.5.x/10.4.x so moving there for 'backport'

TBH I've ran out of steam for fancy diffs and linking issues for stuff that can't be done.

Instead here's the before:

$ yarn outdated
yarn outdated v1.22.22
info Color legend :
 "<red>"    : Major Update backward-incompatible updates
 "<yellow>" : Minor Update backward-compatible features
 "<green>"  : Patch Update backward-compatible bug fixes
Package                 Current Wanted Latest Package Type           URL
@floating-ui/dom        1.6.5   1.6.12 1.6.12 devDependencies        https://floating-ui.com
chokidar                3.6.0   3.6.0  4.0.1  devDependencies        https://github.com/paulmillr/chokidar
dotenv                  16.4.5  16.4.7 16.4.7 devDependencies        https://github.com/motdotla/dotenv#readme
eslint                  8.57.0  8.57.1 9.17.0 devDependencies        https://eslint.org
eslint-plugin-import    2.29.1  2.31.0 2.31.0 devDependencies        https://github.com/import-js/eslint-plugin-import
eslint-plugin-no-jquery 3.0.2   3.1.0  3.1.0  devDependencies        https://github.com/wikimedia/eslint-plugin-no-jquery#readme
eslint-plugin-prettier  5.1.3   5.2.1  5.2.1  devDependencies        https://github.com/prettier/eslint-plugin-prettier#readme
eslint-plugin-yml       1.14.0  1.16.0 1.16.0 devDependencies        https://ota-meshi.github.io/eslint-plugin-yml/
glob                    10.3.5  10.3.5 11.0.0 devDependencies        https://github.com/isaacs/node-glob#readme
jackspeak               2.1.1   2.1.1  4.0.2  resolutionDependencies https://github.com/isaacs/jackspeak#readme
jquery-ui               1.14.0  1.14.1 1.14.1 devDependencies        https://jqueryui.com
jsdom                   24.0.0  24.1.3 25.0.1 devDependencies        https://github.com/jsdom/jsdom#readme
nightwatch              2.4.2   2.4.2  3.9.0  devDependencies        https://nightwatchjs.org
postcss                 8.4.38  8.4.49 8.4.49 devDependencies        https://postcss.org/
postcss-preset-env      9.5.11  9.6.0  10.1.2 devDependencies        https://github.com/csstools/postcss-plugins/tree/main/plugin-packs/postcss-preset-env#readme
prettier                3.2.5   3.4.2  3.4.2  devDependencies        https://prettier.io
semver                  7.5.4   7.5.4  7.6.3  resolutionDependencies https://github.com/npm/node-semver#readme
shepherd.js             10.0.1  10.0.1 14.3.0 devDependencies        https://shepherdjs.dev
sortablejs              1.15.2  1.15.6 1.15.6 devDependencies        https://github.com/SortableJS/Sortable#readme
terser                  5.31.0  5.37.0 5.37.0 devDependencies        https://terser.org
terser-webpack-plugin   5.3.10  5.3.11 5.3.11 devDependencies        https://github.com/webpack-contrib/terser-webpack-plugin
tua-body-scroll-lock    1.5.0   1.5.3  1.5.3  devDependencies        https://github.com/tuax/tua-body-scroll-lock#readme
underscore              1.13.6  1.13.7 1.13.7 devDependencies        https://underscorejs.org
webpack                 5.96.1  5.97.1 5.97.1 devDependencies        https://github.com/webpack/webpack

After:

$ yarn outdated --no-links
yarn outdated v1.22.22
info Color legend :
 "<red>"    : Major Update backward-incompatible updates
 "<yellow>" : Minor Update backward-compatible features
 "<green>"  : Patch Update backward-compatible bug fixes
Package            Current Wanted Latest Package Type          
eslint             8.57.0  8.57.1 9.17.0 devDependencies       
glob               10.3.5  10.3.5 11.0.0 devDependencies       
jackspeak          2.1.1   2.1.1  4.0.2  resolutionDependencies
nightwatch         2.4.2   2.4.2  3.9.0  devDependencies       
postcss            8.4.38  8.4.49 8.4.49 devDependencies       
postcss-preset-env 9.5.11  9.6.0  10.1.2 devDependencies       
semver             7.5.4   7.5.4  7.6.3  resolutionDependencies
shepherd.js        10.0.1  10.0.1 14.3.0 devDependencies       

spokje → closed merge request !10521

commit-code-check.sh wasn't happy, yarn check -s gave me this:

warning "backbone#underscore@>=1.8.3" could be deduped from "1.13.7" to "underscore@1.13.7"
warning Resolution field "ejs@3.1.10" is incompatible with requested version "nightwatch#ejs@3.1.8"
warning Resolution field "nightwatch#semver@7.5.4" is incompatible with requested version "nightwatch#semver@7.3.5"
warning "stylelint#debug@^4.3.7" could be deduped from "4.4.0" to "debug@4.4.0"
warning "eslint#@humanwhocodes/config-array#debug@^4.3.1" could be deduped from "4.4.0" to "debug@4.4.0"
error "espree#acorn" not installed
error "espree#acorn-jsx" not installed
error Found 3 errors.

Not sure if it's something up with my local or a problem with the MR.

No clue either, but I'm officially calling it quits on trying to update any JS dependency.
It's far too tedious with rerolls, canary-in-coal-mine for broken HEADs and multiple branches.

I think we should put time in researching something like Renovate or whatever shiny stuff works on GitLab these days.
IMHO it shouldn't take the roughly 10-15hrs I've spent this time around.

This is by no means a rant against core committers, who can somehow juggle multiple branches almost perfectly, but for mere mortals like me, this is _very_ frustrating and something that looks like it can be achieved with automation far easier than a/this human banging its forehead on a keyboard :)

NW is probably the status for this now.

There is an open issue about dedupe, https://github.com/yarnpkg/yarn/issues/7568. Someone solved that by deleting the lock file and then 'yarn install'.

Locally, that worked for the dedupe errors. Still to do is the resolution one.

automation issue is at 🌱 Set up a formal process for ensuring JavaScript dependencies remain up to date Needs review

So in 11.x and yarn 2 we don't check dependencies because the command doesn't exists. From the docs:

NOTE: The command yarn check has been historically buggy and undermaintained and, as such, has been deprecated and will be removed in Yarn 2.0. You should use yarn install --check-files instead.

The --check-files option doesn't exist anymore.

the deduping doesn't impact our vendored deps so I'd be inclined to just ignore it and remove the check. i'll try to fix it later today but might just remove that

And what about the two 'resolution' warning?

warning Resolution field "ejs@3.1.10" is incompatible with requested version "nightwatch#ejs@3.1.8"
warning Resolution field "nightwatch#semver@7.5.4" is incompatible with requested version "nightwatch#semver@7.3.5"

I think we can ignore the warnings, they might be pre-existing. Should open a follow up to try to clean this up though.

FWIW I got the Nightwatch warning in #25 on HEAD when I was prepping for the live commit at Singapore. Asked @larowlan about it and he suggested ignoring that at the time.

Tagging for the Nightwatch warning followup and adding it to the IS.

I think the warnings are safe to ignore.

I fixed the errors by removing the two sets of acorn data from yarn.lock and rerunning yarn install which has deduplicated them correctly and yarn check now has warnings but no errors:

$ yarn check -s
warning "backbone#underscore@>=1.8.3" could be deduped from "1.13.7" to "underscore@1.13.7"
warning Resolution field "ejs@3.1.10" is incompatible with requested version "nightwatch#ejs@3.1.8"
warning Resolution field "nightwatch#semver@7.5.4" is incompatible with requested version "nightwatch#semver@7.3.5"
warning "stylelint#debug@^4.3.7" could be deduped from "4.4.0" to "debug@4.4.0"
warning "eslint#@humanwhocodes/config-array#debug@^4.3.1" could be deduped from "4.4.0" to "debug@4.4.0"

I can further fix the debug and underscore warnings by removing those from the lockfile and running yarn install again. This just leaves:

$ yarn check -s
warning Resolution field "ejs@3.1.10" is incompatible with requested version "nightwatch#ejs@3.1.8"
warning Resolution field "nightwatch#semver@7.5.4" is incompatible with requested version "nightwatch#semver@7.3.5"

That makes sense with the Nightwatch mis-match, good to narrow everything down. Let's get this in.