Why @google-cloud/storage is listed as an optional dependency?

[anantakrishna]

I just wonder why this package is listed as an optional dependency, and not a usual dependency.

I suspect that because of this the @google-cloud/storage package does not actually get upgraded in my package-lock.json file even after upgrading firebase-admin. For example, I have upgraded to [email protected] which has bumped own dependency on @google-cloud/storage from 5.17.0 to 5.18.0 in #1551, but I have found out that in my package-lock.json it is still 5.14.4!

[akauppi]

I think it's by design, but have not noticed it being mentioned in the Changelogs (I read them meticulously). It did change, at one point.

But about "why"... I don't work for Firebase, but I think the intention is to make also the firebase-admin side more modular. If you don't use Firestore / Storage (this approach applies also to @google-cloud/firestore), those libraries are not automatically pulled in. This makes installing the library lighter. For example, I don't use storage.

I generally like the approach. Only it deserves to be documented so that it doesn't cause surprises for us developers. Namely, sometimes the necessary library is brought in other ways, and things seem to work...

Relevant source link

[akauppi]

p.s. Whether optional dependencies are pulled in also depends on which npm version you use (or other such package tool). Some versions tended to pull optional dependencies, unless instructed otherwise.

I tried with npm 8.12.1 (below) and it seems to also pull them in. What I do know is with CloudFunctions (functions/package.json) I've needed to explicitly add @google-cloud/firestore to it, for things to work.

$ npm install firebase-admin

added 132 packages, changed 2 packages, and audited 240 packages in 11s

10 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities
$ npm list @google-cloud/firestore
asko@ /Users/asko
└─┬ [email protected]
  └── @google-cloud/[email protected]

[anantakrishna]

Yes, adding explicit dependency seems to be the way.

[lahirumaramba]

@akauppi's answer above is correct.
@google-cloud/storage and @google-cloud/firestore are optional by design. Developers relying on other APIs of the SDK can safely remove those dependencies if they are concerned about the SDK size etc. A fresh install of firebase-admin should pull the latest release (minor or patch version in the major version referenced in package.json) of the optional dependencies, but if you already have a package-lock file explicitly adding those dependencies or manually upgrading is the way to keep them updated. Just make sure firebase-admin is compatible with the version you use.

[anantakrishna]

A few questions on this to make sure I understand you right.

1. How would a developer remove those packages installed by a “fresh install of firebase-admin”?
2. How does one “manually upgrade“ these optional dependencies without explicitly adding them to own package.json?
3. Would installing a new version of firebase-admin that requires a newer version of, say, @google-cloud/storage upgrade the latter as well? Provided @google-cloud/storage is not added explicitly as dependency in my package.json.

[lahirumaramba]

1. Good question. I don't know if there is an easy way to remove a transitive dependency (you probably have to cleanup your node_modules directory), but you can skip the optional dependencies when you install a package with --omit=optional. For firebase-admin you can run: npm install firebase-admin --omit=optional.
2. You need to add them to the package.json with the version info so your production environment knows what version to install. Also see https://docs.npmjs.com/cli/v8/configuring-npm/package-json#overrides
3. Yes, if the new version of firebase-admin is shipped with a new version of the optional dependencies (updated version in package.json).

[anantakrishna]

Developers relying on other APIs of the SDK can safely remove those dependencies if they are concerned about the SDK size etc.

It seems that this path does not work, actually. I've removed the @google-cloud/firestore package from my lock file, there is no use of it in the project, and I'm getting the following error from firebase-tools on functions:shell or deploy:

Error: Cannot find module '@google-cloud/firestore/build/src/path'
Require stack:
- C:\repo\node_modules\firebase-admin\lib\firestore\index.js
- C:\repo\node_modules\firebase-functions\lib\common\providers\firestore.js       
- C:\repo\node_modules\firebase-functions\lib\v1\providers\firestore.js
- C:\repo\node_modules\firebase-functions\lib\v1\index.js
- C:\repo\lib\index.js
- C:\repo\node_modules\firebase-functions\lib\runtime\loader.js
- C:\repo\node_modules\firebase-functions\lib\bin\firebase-functions.js

@lahirumaramba is it by design? If not, do you suggest filing a bug in this repo or in the firebase-functions one?