Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Commercial product leakage to package.json #13749

Closed
knoobie opened this issue May 12, 2022 · 7 comments · Fixed by #14014
Closed

Commercial product leakage to package.json #13749

knoobie opened this issue May 12, 2022 · 7 comments · Fixed by #14014
Assignees
@taefi
Labels
Impact: High Released with Vaadin 23.1.3 Released with Vaadin 23.2.0 Severity: Blocker

Comments

@knoobie
Copy link
Contributor

knoobie commented May 12, 2022 •
edited
Loading

Description of the bug

Currently commercial projects like vaadin-grid-pro are added to the package.json and package-lock.json even tho only vaadin-core is used as dependency.

Expected behavior

Not used dependencies / commercial products are NOT added into the package.json or package-lock.json.

Minimal reproducible example

  • Create a V23 app in start.vaadin.com
  • Replace vaadin dependency with vaadin-core
  • Delete package.json & package-lock.json
  • mvn
  • Look at the nearly created package.json containing commercial products

Versions

  • Vaadin / Flow version: V23 + V23.1.0.beta1 tested
  • Java version: 11
@mcollovati
Copy link
Collaborator

It seems that only vaadin-core artifact has vaadin_versions.json and it lists all Vaadin components, core and pro.
Perhaps vaadin_versions.json should be present in both artifacts and read and merged during build process.

@Artur-
Copy link
Member

Artur- commented May 16, 2022

Yes, there should be separate version jsons in the two jars. Earlier it did not matter that vaadin-core listed all the versions as only what was found by scanning for @NpmPackage was installed but now I think Flow installs everything it finds in versions.json.

Technically it might be easier to name the files differently in the two jars so you can just fetch from the classpath using a unique name

@haijian-ccc
Copy link

This is actually a critical bug. It's not uncommon that companies have license check in the build script, upon detecting commercial licenses, the build fails which makes Vaadin 23 not usable. And there is no workaround, as Vaadin always forces the commercial products, even the user only intends to use the free ones with vaadin-core.

@chkpnt
Copy link

chkpnt commented Jun 9, 2022 •
edited
Loading

I can confirm this bug prevents me to update to v23. I do not have a license checker integrated in my build which prevents me from doing so, but it's the CVAL-3.0 itself, which I would violate!

"Use Licensed Software" shall mean either directly interacting with, including without limitations using the user interface of, running on workstation or installing, the Licensed Software during Project or editing Project source code file that refers to or depends on Licensed Software either directly or indirectly. Developer who edits source code that can not be compiled and/or run without a copy of Licensed Software is considered to Use Licensed Software. Interacting with a test server that runs Licensed Software as a part of automated test suite is not consider as Use of Licensed Software, but the maintainers of the mentioned test suite are considered to Use Licensed Software.

@taefi taefi self-assigned this Jun 14, 2022
@ZheSun88
Copy link
Contributor

ZheSun88 commented Jun 17, 2022 •
edited by taefi
Loading

I have created this PR to generate different json file for vaadin and vaadin-core

and the json will be included into different jars.

Platform includes free components into vaadin-core-versions.json and includes it into vaadin-core JAR
Platform includes commertial components into vaadin-versions.json and includes it into vaadin JAR

i think flow will need to do corresponding changes to make it include the correct json into the generated package.json files.

taefi added a commit that referenced this issue Jun 21, 2022
@taefi
fix: separate core and commercial components version files
1f8c441 
Fixes: #13749

Previously, the vaadin_versions.json contained
both core and commercial components listed
which led to including them all in package.json
even if the user only used vaadin-core. Now
platform generates vaadin-core-version.json in
vaadin-core and vaadin-version.json to include
commercial components in vaadin artifact.
This commit will adopt having separate files
while generating package.json and pinning the
platform dependencies.
@taefi taefi mentioned this issue Jun 21, 2022
Merged
8 tasks
taefi added a commit that referenced this issue Jun 23, 2022
@taefi
fix: separate core and commercial components version files (#14014)
23f5496 
* fix: separate core and commercial components version files

Fixes: #13749

Previously, the vaadin_versions.json contained
both core and commercial components listed
which led to including them all in package.json
even if the user only used vaadin-core. Now
platform generates vaadin-core-version.json in
vaadin-core and vaadin-version.json to include
commercial components in vaadin artifact.
This commit will adopt having separate files
while generating package.json and pinning the
platform dependencies.
@haijian-ccc haijian-ccc mentioned this issue Jun 28, 2022
Closed
taefi added a commit that referenced this issue Jun 28, 2022
@taefi
fix: separate core and commercial components version files (#14014)
abb34bf 
* fix: separate core and commercial components version files

Fixes: #13749

Previously, the vaadin_versions.json contained
both core and commercial components listed
which led to including them all in package.json
even if the user only used vaadin-core. Now
platform generates vaadin-core-version.json in
vaadin-core and vaadin-version.json to include
commercial components in vaadin artifact.
This commit will adopt having separate files
while generating package.json and pinning the
platform dependencies.

(cherry picked from commit 23f5496)
taefi added a commit that referenced this issue Jun 29, 2022
@taefi @ZheSun88
fix: separate core and commercial components version files (#14093)
bc0ba79 
* fix: separate core and commercial components version files (#14014)

* fix: separate core and commercial components version files

Fixes: #13749

Previously, the vaadin_versions.json contained
both core and commercial components listed
which led to including them all in package.json
even if the user only used vaadin-core. Now
platform generates vaadin-core-version.json in
vaadin-core and vaadin-version.json to include
commercial components in vaadin artifact.
This commit will adopt having separate files
while generating package.json and pinning the
platform dependencies.

(cherry picked from commit 23f5496)

* test: add tests for handling separate versions in NodeUpdater (#14079)

Tests are added for changes done in PR
#14014

(cherry picked from commit 7140d32)

* chore: update log message after versions.json separation (#14083)

(cherry picked from commit 1b86801)

Co-authored-by: Zhe Sun <[email protected]>
vaadin-bot pushed a commit that referenced this issue Jun 29, 2022
@taefi @ZheSun88 @vaadin-bot
fix: separate core and commercial components version files (#14093)
0ab1697 
* fix: separate core and commercial components version files (#14014)

* fix: separate core and commercial components version files

Fixes: #13749

Previously, the vaadin_versions.json contained
both core and commercial components listed
which led to including them all in package.json
even if the user only used vaadin-core. Now
platform generates vaadin-core-version.json in
vaadin-core and vaadin-version.json to include
commercial components in vaadin artifact.
This commit will adopt having separate files
while generating package.json and pinning the
platform dependencies.

(cherry picked from commit 23f5496)

* test: add tests for handling separate versions in NodeUpdater (#14079)

Tests are added for changes done in PR
#14014

(cherry picked from commit 7140d32)

* chore: update log message after versions.json separation (#14083)

(cherry picked from commit 1b86801)

Co-authored-by: Zhe Sun <[email protected]>
taefi added a commit that referenced this issue Jul 1, 2022
@vaadin-bot @taefi
fix: separate core and commercial components version files (#14093) (#…
7462cbe 
…14104)

* fix: separate core and commercial components version files (#14014)

* fix: separate core and commercial components version files

Fixes: #13749

Previously, the vaadin_versions.json contained
both core and commercial components listed
which led to including them all in package.json
even if the user only used vaadin-core. Now
platform generates vaadin-core-version.json in
vaadin-core and vaadin-version.json to include
commercial components in vaadin artifact.
This commit will adopt having separate files
while generating package.json and pinning the
platform dependencies.

(cherry picked from commit 23f5496)

* test: add tests for handling separate versions in NodeUpdater (#14079)

Tests are added for changes done in PR
#14014

(cherry picked from commit 7140d32)

* chore: update log message after versions.json separation (#14083)

(cherry picked from commit 1b86801)

Co-authored-by: Zhe Sun <[email protected]>

Co-authored-by: Soroosh Taefi <[email protected]>
@vaadin-bot
Copy link
Collaborator

This ticket/PR has been released with Vaadin 23.1.3.

@vaadin-bot
Copy link
Collaborator

This ticket/PR has been released with Vaadin 23.2.0.

@lmorocz lmorocz mentioned this issue Nov 22, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@taefi taefi

Labels
Impact: High Released with Vaadin 23.1.3 Released with Vaadin 23.2.0 Severity: Blocker
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: separate core and commercial components version files vaadin/flow
9 participants
@Artur- @chkpnt @knoobie @mcollovati @vaadin-bot @ZheSun88 @mshabarov @taefi @haijian-ccc