QQ: leads

UK5DS29L2

QQ:
https://github.com/spryker-shop/shop-ui/commit/66de06aa35bab12efa6e0ec5a363be299acc0ada
leads to

Module not found: Error: Can't resolve 'password-validator' in '/vendor/spryker-shop/shop-ui/src/SprykerShop/Yves/ShopUi/Theme/default/components/molecules/password-complexity-indicator'

where was this package (password-validator) added?

Valerii Trots

Seems like here - https://api.release.spryker.com/release-group/3130.

UK5DS29L2

🤔 usng composer files from
https://github.com/spryker-shop/suite/tree/1.7
and it fails with the above message

UK5DS29L2

and the versions do match, but still fails

Valerii Trots

It's not about composer. In the release group from above you can see related project level changes.

https://github.com/spryker-shop/suite/pull/692/files

UK5DS29L2

considering
https://github.com/spryker-shop/suite/blob/1.7/package.json
doesn't have it, but packages installed with composer still require it, wouldn't it be better to make it part of the 1.7 release?
well, @UJLM6CAFR you wanted compatible-breaking change we get next time, this is it 😉

Valerii Trots

I don't know what these tags are about to be honest.

UK5DS29L2

np, what is important is that they were meant to point to stable release, which is not currently the case

Valerii Trots

1.7 seems to be from September or something.

Discussed changes are from December.
Or I didn't get it.

UK5DS29L2

the long discussion we had with @UJLM6CAFR was that Spryker releases something under same version contstraint that is supposed to be a non-breaking change, and it provides breaking changes anyway.
yes, 1.7 points to older release, but that means your versions constaints are not pointing to stable release files

UK5DS29L2

which was the whole problem all along ;]

giovanni.piemontese

U have to include password-validator in package.json

giovanni.piemontese

it is a project level migration needed after composer update with new password policy..

giovanni.piemontese

password-complexity TS needs password-validator library

Christian von Schassen

Jan, does Giovanni's suggestion help? Otherwise we should probably make an appointment with a member of our architecture team to discuss it. What do you think?
(By the way, thanks for being such a great community contributor, @UL65CH0MC)

UK5DS29L2

@UL65CH0MC I SEE it needs it, but I'm trying to use official spryker release so we can upgrade later to 1.8 (when it's out) by using Jarvis. Why wasn't the release adjusted to be a working one? I'm just poining out the releases are still not reliable as they are.
Yes, we can update packages to non-release ones, but in that case why should we use releases at all if they only work when they are released and not a month/two after? That's not how releases are supposed to work and you know it 😉

Valerii Trots

Your main concern here is that latest spryker-shop/shop-ui that requires password-validator had to be released as a major with appropriate migration guide, right?

UK5DS29L2

No. My main concern is:
• latest release is 1.7 on https://github.com/spryker-shop/suite/releases
• in its composer.json it has 1.48 spryker-shop/shop-ui as compatible: https://github.com/spryker-shop/suite/blob/1.7/composer.json#L143 (meaning it already requires password-validator)
• in package.json of 1.7, however there's no such dependency: https://github.com/spryker-shop/suite/blob/1.7/package.json
I can no longer benefit from bugfixes

UK5DS29L2

do I really need migration guide from 1.7 to 1.7? 🙂

Stanislav Matveyev

https://raw.githubusercontent.com/spryker-shop/suite/1.7/composer.lock
has

{
            "name": "spryker-shop/shop-ui",
            "version": "1.44.1",

And updated version of shop-ui which requires "password-validator": "~5.1.0" in package.json is
https://github.com/spryker-shop/shop-ui/releases/tag/1.48.0

Stanislav Matveyev

Unfortunatelly we cannot force npm dependecies update using composer. We have ideas how to change it in the future. But probably it will require major update of shop-ui

UK5DS29L2

@UKBTMFXMJ but you can use semver, and stop releasing breaking change as a same-minor version 😉 Right now it's up to spryker users to check whether the coe change in the one of hundreds of spryker packages is a bugfix or a breaking change

UK5DS29L2

which is a PITA