Ability to update npmDependencies for Scala.js projects

[exoego]

It would be super-helpful for Scala.js users if Scala Steward update npmDependencies on scalajs-bundler plugin.
npmDependencies is a setting key to define Node.js modules and its version, in a form of String -> String, like

npmDependencies ++= Seq(
  "aws-sdk" -> "2.743.0",
  "archiver" -> "5.0.0",
)

Suggestion for implementation (and comment for consideration)

1. Extract npm module names and versions
   • Maybe run show npmDependencies then parse the result ?
2. Fetch latest version of each npm modules
   • jsdelivr's /package/npm/:name API] could be used.
   • name -> latestVersion pairs should be cached, since external API invokations are costly.
3. Rewrite all occurence of name -> version to name -> latestVersion in *.sbt and project/*.(sbt|scala)
4. Creates a PR

[ptrdom]

I made a small POC of how this issue could be solved with the use of Dependabot - https://github.com/ptrdom/scalajs-bundler-dependabot-interop. Basically instead of defining npmDependencies explicitly in build.sbt, you would have a package.json, which sbt would then read and initialize an appropriate npmDependencies setting value. Presence of minimalistic package.json allows Dependabot to kick in.

I do not think there is a good purpose in trying to replicate functionality in scala-steward of an already existing and trusted tool.

Side note would be that there seems to be a non-ideal general trend where sbt plugins overgenerate - for a lack of better word - files of other tools when trying to interop with them - whether its npm, Docker or others - and this breaks various useful functionality that already exists in those other tools. It seems useful to help sbt users unfamiliar with other tools to start out, but breaks various workflows when it comes to full project lifecycle.

[fthomas]

I do not think there is a good purpose in trying to replicate functionality in scala-steward of an already existing and trusted tool.

Side note would be that there seems to be a non-ideal general trend where sbt plugins overgenerate - for a lack of better word - files of other tools when trying to interop with them - whether its npm, Docker or others - and this breaks various useful functionality that already exists in those other tools. It seems useful to help sbt users unfamiliar with other tools to start out, but breaks various workflows when it comes to full project lifecycle.

I agree with this sentiment. I also think that that we do not have enough active contributors to support another package ecosystem.