[Suggestion]Better dependencies management of the repo

[e-cloud]

In the last few days, i find out that many dependencies of angular-cli and then try to get my feet wet.

And I just find @hansl #3488 also updates some of the dependencies. But I think it's less perfect.

---

My opinions

As the repo is a host for several packages, what does the dependencies means for the repo itself? It will not be published.

Let's say the repo is the host.

In fact, the host is responsible for linting, building and testing the real-world packages. Without tests, the host theoretically ought to have devDependencies only.

However, in real development, developers need to run unit tests and write code with the power of Typescript and IDE. So, we have to install dependencies of those packages. (Note: e2e tests don't require that because they install dependencies independently)

Therefore, it can be concluded that the dependencies field in the package.json of the host itself, should be the combination of the dependencies of those several packages. And then, the update workflow of the dependencies should be:

• If they are the dependencies of those packages, developer should update them in those packages' package.json
  • then, make a join of the packages' dependencies and make a update in host's package.json
  • one should not directly add dependencies into dependencies field of host's package.json
• If they are the devDependencies, of course they should be updated in devDependencies in package.json of repo itself.
• If there is duplication between dependencies and devDependencies, I would perfer to remove it from devDependencies

The currents status is, lacking a util to sync the dependencies from the packages and a note to warn contributor not to manually update dependencies in repo's package.json

[clydin]

yarn workspaces as been implementing which eliminates the duplication of dependencies.

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}