3.5.2 to 3.5.3 has breaking axios version change

[thomasms]

I am using invenio v12 but since the release of 3.5.3 of this library I can no longer do the webpack build.

It seems 3.5.2 uses axios "^0.21.0", inline with invenio-communities, but 3.5.3 now uses "^1.8.2" which breaks my build via invenio webpack buildall

npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: invenio-assets@2.0.0
npm ERR! Found: axios@0.21.4
npm ERR! node_modules/axios
npm ERR!   axios@"^0.21.0" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer axios@"^1.8.2" from react-invenio-forms@3.5.3
npm ERR! node_modules/react-invenio-forms
npm ERR!   react-invenio-forms@"^3.0.0" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /root/.npm/eresolve-report.txt for a full report.

Is there anyway to force 3.5.2 instead of 3.5.3 from the invenio-cli level, without having to upgrade from v12 to v13?

Any help on this matter is much appreciated.

[thomasms]

Here is a simply package.json to illustrate the issue:

{
  "name": "invenio",
  "version": "1.0.0",
  "description": "A test application for Invenio RDM dependencies.",
  "main": "index.js",
  "scripts": {
    "start": "webpack --mode development",
    "build": "webpack --mode production"
  },
  "dependencies": {
    "@semantic-ui-react/css-patch": "^1.0.0",
    "react-router-dom": "^6.3.0",
    "react-invenio-forms": "^3.0.0",
    "axios": "^0.21.0",
    "formik": "^2.1.0",
    "i18next": "^20.3.0",
    "@tinymce/tinymce-react": "^4.3.0",
    "i18next-browser-languagedetector": "^6.1.0",
    "lodash": "^4.17.0",
    "luxon": "^1.23.0",
    "path": "^0.12.0",
    "prop-types": "^15.7.0",
    "qs": "^6.9.0",
    "react": "^16.13.0",
    "react-dom": "^16.13.0",
    "react-i18next": "^11.11.0",
    "react-redux": "^7.2.0",
    "react-searchkit": "^2.0.0",
    "redux": "^4.0.0",
    "redux-thunk": "^2.3.0",
    "semantic-ui-css": "^2.4.0",
    "semantic-ui-react": "^2.1.0",
    "tinymce": "^6.7.2",
    "yup": "^0.32.11"
  },
  "devDependencies": {
    "webpack": "^5.0.0",
    "webpack-cli": "^4.0.0"
  },
  "keywords": [
    "invenio",
    "react"
  ],
  "author": "Ted tester"
}

npm install gives the following error, which is the same I get when trying to do invenio webpack buildall:

npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: invenio@1.0.0
npm error Found: axios@0.21.4
npm error node_modules/axios
npm error   axios@"^0.21.0" from the root project
npm error
npm error Could not resolve dependency:
npm error peer axios@"^1.8.2" from react-invenio-forms@3.5.3
npm error node_modules/react-invenio-forms
npm error   react-invenio-forms@"^3.0.0" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.

[Devon-McClendon]

I also encountered this issue. I was able to work around it by running 'invenio webpack create' then navigating to the invenio instance /assets directory and running 'npm install react-invenio-forms@3.5.2 --legacy-peer-deps' and then running the 'invenio webpack buildall' command. For context I was running the build in docker and put these commands in the Dockerfile.

[tmorrell]

All packages in v12 have been updated to also use axios 1.8.2, so you should be able re-run invenio-cli install or upgrade all the invenio packages and get an environment that should build. If that's not the case, please add the details of your setup here.

[thomasms]

Unfortunately, invenio-cli install doesn't work for me. I get the following error:

npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: invenio-assets@2.0.0
npm error Found: axios@0.21.4
npm error node_modules/axios
npm error   axios@"^0.21.0" from the root project
npm error
npm error Could not resolve dependency:
npm error peer axios@"^1.8.2" from react-invenio-forms@3.5.3
npm error node_modules/react-invenio-forms
npm error   react-invenio-forms@"^3.0.0" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.

I can indeed see that axios was bumped to 1.8.2 in invenio-communities 13.1.1, however, I don't want to upgrade at this point in time. I would prefer not to upgrade packages in this manner and instead I would like to manage upgrades when we are ready to upgrade, no matter how minor the change. I thought the whole point in a Pipfile.lock was to avoid such issues?

[tmorrell]

The javascript dependencies aren't controlled by Pipfile.lock. It's a limitation that the community is aware of and is working on.

If you don't want to upgrade invenio-communities, why are you upgrading react-invenio-forms?

[thomasms]

Thanks for the response, and sorry if I am missing something, but that's the whole point of this issue. I didn't update anything - my Pipfile.lock has remained the same.

It's because invenio-communities allows ^v3.0.0 which because, as you note, Pipfile.lock is not responsible for the node packages, 3.5.3 was released it then conflicted with axios line 50.

I have a CI setup so this builds every day as a docker image, hence when 3.5.3 was added to npm 7 days ago, my build broke, even though nothing changed on my side.

In my honest opinion this should not happen for production software but please correct me if I have misunderstood?

[tmorrell]

I agree that it's not great, but currently there is no locking of npm package versions. So if you rebuild on a regular basis and pull in new npm versions you will sometimes need to update the corresponding python packages.

There is work to add javascript locking, but it's not available yet

[zyzzyxdonta]

This is not just a rebuild issue though. If you set up an entirely new RDM v12 instance using cookiecutter right now, the same problem arises.

[tmorrell]

I just installed a new cookicutter of v12 and didn't run into this issue. If you installed your instance in the middle of the releases, you may need to delete Pipfile.lock and reinstall.

If you have done a completely clean cookicutter now and are running into the issue, please copy over your Pipfile.lock

[zyzzyxdonta]

You're right. A new setup does work. I assume there was some cache which caused it to not work by simply removing the lock file. Sorry 🙈

[tmorrell]

No worries! The js dependency management is the weakest part of the codebase in my opinion, and it's easy to get tripped up by it.

[thomasms]

We plan to update as you suggest in the coming weeks but for the meantime we will use the npm install react-invenio-forms@3.5.2 patch to get the build working again.

Thanks for the help.