Versions from package-lock.json are not propagated to output FastBoot package.json

[nathanhammond]

It's possible to end up with incompatible versions of node modules installed in a FastBoot build.

Addon's package.json:

{
  "dependencies": {
    "@example/left-pad": "^1.2.0"
  },
  "ember-addon": {
    "fastbootDependencies": [
      "@example/left-pad"
    ]
  }
}

package-lock.json:

{
  "@example/left-pad": "1.2.3"
}

... time passes ...

npm version minor "@example/left-pad"

Now it's possible that the npm install at build time (using package-lock.json) and the npm install for a FastBoot required module (package.json spit out at build time) end up getting different incompatible versions. These should be tied together.

---

Workaround in our codebase (contains unnecessary code regarding fastbootDependencies for this example because our use case also needed to track things included from that top-level module):

// /index.js in an addon.
module.exports = {
  included() {
    this._super(...arguments);

    // FastBoot dependencies must be whitelisted
    let moduleName = '@example/left-pad';
    let fastbootDependencies = [moduleName];
    let version = require(`${moduleName}/package`).version;

    // Pin the version to the one at build time.
    this.pkg.dependencies[moduleName] = version;
    this.pkg['ember-addon'].fastbootDependencies = fastbootDependencies;
  }
};