Source JavaScript modules from npm #2983

New Issue

GiteaMirror · 2025-11-02T04:56:08-06:00

GiteaMirror commented

2025-11-02 04:56:08 -06:00

Originally created by @silverwind on GitHub (Feb 27, 2019).

JavaScript modules are currently manually placed in public/vendor/plugins and updating them is not straightfoward as one needs to both manually copy new files and update the licences page. I'd suggest:

Populate public/vendor/plugins by adding all modules to package.json and copying the relevant files from node_modules in a make task.
Remove the JavaScript Licences page, I don't think it is actually useful and just cumbersome to update.

Originally created by @silverwind on GitHub (Feb 27, 2019). JavaScript modules are currently manually placed in `public/vendor/plugins` and updating them is not straightfoward as one needs to both manually copy new files and update the licences page. I'd suggest: - Populate `public/vendor/plugins` by adding all modules to `package.json` and copying the relevant files from `node_modules` in a make task. - Remove the JavaScript Licences page, I don't think it is actually useful and just cumbersome to update.

GiteaMirror added the type/proposal type/refactoring labels 2025-11-02 04:56:08 -06:00

GiteaMirror closed this issue

2025-11-02 04:56:08 -06:00

GiteaMirror commented

2025-11-02 04:56:09 -06:00

@techknowlogick commented on GitHub (Feb 27, 2019):

I'm in favour of moving to npm for JS modules (in fact I recently forked a project to do exactly this to it), however the JavaScript Licences page is a requirement that we provide a list of the licenses used (perhaps this could be autogenerated from package.json info of each project).

@techknowlogick commented on GitHub (Feb 27, 2019): I'm in favour of moving to npm for JS modules (in fact I recently forked a project to do exactly this to it), however the JavaScript Licences page is a requirement that we provide a list of the licenses used (perhaps this could be autogenerated from package.json info of each project).

GiteaMirror commented

2025-11-02 04:56:09 -06:00

@silverwind commented on GitHub (Feb 27, 2019):

Yes, most npm packages have license info in their package.json. Would you think the license name and a link to the package homepage would suffice? I guess not all packages would feature a LICENSE file.

@silverwind commented on GitHub (Feb 27, 2019): Yes, most npm packages have license info in their package.json. Would you think the license name and a link to the package homepage would suffice? I guess not all packages would feature a `LICENSE` file.

GiteaMirror commented

2025-11-02 04:56:09 -06:00

@silverwind commented on GitHub (Feb 28, 2019):

I'm thinking of going one step further and adding a minimal webpack build process. It could produce a single bundle.min.js that we commit to git.

@silverwind commented on GitHub (Feb 28, 2019): I'm thinking of going one step further and adding a minimal webpack build process. It could produce a single `bundle.min.js` that we commit to git.

GiteaMirror commented

2025-11-02 04:56:09 -06:00

@apricote commented on GitHub (Feb 28, 2019):

Committing the bundle.min.js will cause more conflicts in PRs, in the same way that it currently happens with the css bundle. Not a blocker, just something to think about.

@apricote commented on GitHub (Feb 28, 2019): Committing the `bundle.min.js` will cause more conflicts in PRs, in the same way that it currently happens with the css bundle. Not a blocker, just something to think about.

GiteaMirror commented

2025-11-02 04:56:09 -06:00

@silverwind commented on GitHub (Feb 28, 2019):

Yeah, I don't like committing build files either. We could require Node.js and a Internet connection to compile both CSS and JS during the build.

@silverwind commented on GitHub (Feb 28, 2019): Yeah, I don't like committing build files either. We could require Node.js and a Internet connection to compile both CSS and JS during the build.

GiteaMirror commented

2025-11-02 04:56:10 -06:00

@apricote commented on GitHub (Mar 1, 2019):

The build server could generate the files and commit them for master branch builds.

Upsides:

No more conflicts in PRs that touch these files,
contributers that work on Go code won't need Node.js,
our security improves slightly, because people can not hide malicious code in the minified JS bundle.

Downsides:

Reviewers will have to build it locally

@apricote commented on GitHub (Mar 1, 2019): The build server could generate the files and commit them for `master` branch builds. Upsides: - No more conflicts in PRs that touch these files, - contributers that work on Go code won't need Node.js, - our security improves slightly, because people can not hide malicious code in the minified JS bundle. Downsides: - Reviewers will have to build it locally

GiteaMirror commented

2025-11-02 04:56:10 -06:00

@CL-Jeremy commented on GitHub (Mar 13, 2019):

The build server could generate the files and commit them for master branch builds.

Does this also mean these files will be added to .gitignore, while CI builds will do git add --force? That'd liberate me from doing git checkout HEAD -- <files> whenever those files get generated.

@CL-Jeremy commented on GitHub (Mar 13, 2019): > The build server could generate the files and commit them for `master` branch builds. Does this also mean these files will be added to `.gitignore`, while CI builds will do `git add --force`? That'd liberate me from doing `git checkout HEAD -- <files>` whenever those files get generated.

GiteaMirror commented

2025-11-02 04:56:10 -06:00

@silverwind commented on GitHub (Nov 21, 2019):

This is in progress. Not all libs are sourceable from npm but some might be. We can handle them on a case-per-case basis, no need to keep this open.

@silverwind commented on GitHub (Nov 21, 2019): This is in progress. Not all libs are sourceable from npm but some might be. We can handle them on a case-per-case basis, no need to keep this open.

GiteaMirror referenced this issue

2025-11-02 12:16:34 -06:00

[PR #2983] [CLOSED] Reduce memory usage on Blob.Data #16695

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#2983