[spec] peerDependencies and shrinkwrap

[villadora]

peerDependencies is required

In front-end, there are many popular libs is based on some hot packages like 'zepto', 'jquery'. For any of these plugins, currently they have to depend on backbone. and their code without modification might be very dangerous in the cortex.

Dangerous for plugins like bootstrap

In bootstrap source code, plugins are initialized like following:

(function($) {
 ....
})(jQuery);

If we only change it to:

(function($) {
 ....
})(require('jquery');

In cortex.json:

{
   dependencies:{
        "jquery": "^1.9.1"
  }
}

When in the developed project, people use the same version of jquery. everything is fine. After some day, jquery update to 2.0.0, and the user use the latest jquery.

Now we have 2 version of jquery in one project. and that is not the worst part. Bootstrap extends jquery@1.9.2, but in client code, require('jquery') returns jquery@2.0.0. the plugins can never be get by client code and become useless. And no way to expose the plugin out.

Temporally, this is what we should do to modify the code:

(function($) {
})(require('jquery');
module.exports = require('jquery');

This is work ok now, if So now when people use bootstrap:

var B = require('bootstrap'); // this is the jquery that from bootstrap
B('.tooltip').tooltip();

var $ = require('jquery'); // this is the jquery from client code, maybe not the same as previous one

What compoents changed for backbone

backbone can use either jquery or zepto, it does not make sense to let it depend on both 'zepto' and 'jquery'. So there is no declaration of dependencies on this two libs, but users have to init it by themselves.

var Backbone = require('backbone');
Backbone.$ = require('jquery'); // or require('zepto');

This works well for components-backbone.

peerDependencies

When adding peerDependencies, cortex should check the conflicts and meetness for the host package.

• Install peerDependencies implicit? or client code should declare one explicit.

  shrinkwrap

How to handle peerDependencies? Depends on whether we force user to declare the host package.

• Ignore, only do check
• save to shrinkwrap