[Feature]: @o3r/create should handle dependency harmonization in mono-repos

[malek-benazzouz]

Context

When generating a project using @o3r/create, today we do not have a way of automatically synchronize (or "harmonize") our dependencies versions between the different libraries/applications.

Proposal

We could use the eslint @o3r/json-dependency-versions-harmonize rule to handle this harmonization.

Example of usage:

"harmonize": "eslint ./**/*.json  --rule '@o3r/json-dependency-versions-harmonize: ['error']' --fix"

(source: micro frontend poc)

To clarify:

• When to run this command? In an npm pre-install script?

Notes:

• If using the eslint rule is not satisfactory, another tool we could explore is syncpack.

[kpanot]

Hi

Thank your for the report.
We can complete a bit your issue with the 2 following items:

• Reduce to only **/package.json the run of @o3r/json-dependency-versions-harmonize
• Run @o3r/yarnrc-package-extensions-harmonize yarn based repository

[matthieu-crouzet]

We should install eslint by default on a o3r monorepo (add an option skipLinterInstallation)
add a command in the package.json "harmonize:version": "eslint '**/package.json*' '.yarnrc.yml' --quiet --fix",
This command should be run on postinstall
Maybe we should re-run the install after the harmonization (becareful difference between yarn and npm)

[malek-benazzouz]

Additional note:
Today, without the harmonization, the following scenario occurs:

If I generate a new project with an app using o3r generator, then try to update o3r deps to a later version:

npm create @o3r project # Uses o3r deps v11.5.6
cd project
ng g application app
ng update @o3r/[email protected]

Result:
The ng update command updates the dependencies in the root package.json file, but not in the app package.json file.
Then it immediately installs the new versions, without harmonizing, which leads to a version mismatch, which leads to a node_modules folder being created in apps/app/ folder. This apps/app/node_modules is also referenced in the package-lock.json file, which leads to further issues, unless manually updating the package-lock.json file.

Running the harmonization command in postinstall script will probably not fix this scenario, because package-lock.json file is already corrupted at that stage. To be checked.