package.json got updated unexpectedly with mvn command

[ZheSun88]

Description of the bug / feature

the package.json got updated unexpectedly with mvn command

Minimal reproducible example

git clone [email protected]:vaadin/docs.git
cd docs
git checkout v21
mvn install -Pproduction (the package.json looks like [this](https://github.com/vaadin/docs/pull/727/files))
mvn (those mixin and polymer dependency will be added)

this is how the production profile has been set

Expected behavior

package.json should be kept the same

Actual behavior

the package.json got updated

Versions:

- Vaadin / Flow version: Vaadin 21. flow 8.0

related conversation can be found on slack

[ZheSun88]

furthermore, if i manually remove the package.json, then run mvn install -Pproduction the generated file removes extra dependencies, like :

-    "date-fns": "^2.16.1",
-    "lit": "2.0.0-rc.3",
-    "lumo-css-framework": "^4.0.8",
-    "promise-file-reader": "^1.0.3",
-    "vanilla-colorful": "^0.5.3"
+    "lit": "2.0.0-rc.3"

this should not happen either, as those dependencies are needed for building the project.

[web-padawan]

Note, at least lit should not be removed because it's present in NodeUpdater. https://github.com/vaadin/flow/blob/7cab180688c94fdf2a471249b150ae8531b73a93/flow-server/src/main/java/com/vaadin/flow/server/frontend/NodeUpdater.java#L368

I think the fact that manually added dependencies get removed is a known problem.

[ZheSun88]

@web-padawan lit has not been removed. as this is V21 branch and at the moment, the released version of V21.0.0 is using lit 2.0.0-rc3

so i think all other dependencies mentioned in my previous comment are the manually added ones.

[mshabarov]

Some observations:

1. Running mvn install -Pproduction with v21 Starter project gives the opposite result: polymer and mixin deps are added into package.json.
2. Running mvn install with docs project doesn't update package.json.

I couldn't find the existing ticket about manually added dependencies get removed.

[caalador]

Any manually added or changed dependencies should not be touched so if there is a case where this happens a ticket should be created with steps to reproduce as no user changes should be changed.

Only instance where user set versions may change is when a user has set a package that at some point becomes the same as the Vaadin version at which point it becomes FW handled and may later update or be removed if the project drops NpmPackage (or a extremely rare case of removed default dependency happens)

[web-padawan]

user has set a package that at some point becomes the same as the Vaadin version at which point it becomes FW handled

BTW this is the case for date-fns in Vaadin 22 (see latest branch of docs repo). Previously it was used in some examples, but starting from Vaadin 22 it became part of DatePickerFlow and is now managed by Flow itself.

Anyways, the original issue about Polymer and mixins being added / removed is the main problem here.

[caalador]

In this ticket 2 different collection usages is used the mvn install -Pproduction uses maven and the command mvn executes spring-boot:run which uses the Spring add-on VaadinServletContextInitializer:DevModeServletContextListener

The difference is that -Pproduction collects what is used and spring-boot:run collects everything on classpath. Is there something that is broken when running the production build?

[mshabarov]

To be retested with Vaadin 23.2 after this fix https://github.com/vaadin/flow/pull/14556 .