[task] to resolve aurelia-binding v2/v1 duplication in webpack/jspm bundles

[3cp]

Originated from aurelia/templating#575 (comment)

Previously @EisenbergEffect released new parser in aurelia-binding v2 to make it a safe opt-in. But since then, aurelia core libs have been updated to depend on v2.

But if you have some 3rd party plugin (very likely) still asks aurelia-binding ^1.x.x in the package.json, you end up with 2 versions of binding in your node_modules (one direct, another one under the plugin folder).

webpack tries to respect the plugin's dependency, hence bundled 2 versions of aurelia-binding.

The end result is all sorts of weird bugs. The first thing you can notice is the repeat.for creates extra entry on array push. Due to Array.prototype.push has been patched twice.

To solve the problem, based on the audit result of all packages depend on aurelia-binding

Core packages (7) all on ^2.0.0

aurelia-framework
aurelia-i18n
aurelia-templating
aurelia-templating-binding
aurelia-templating-resources
aurelia-templating-router
aurelia-validation

Non-core (7) but on ^2.x.x

aurelia/ux ^2.0.0
aurelia/ui-virtualization ^2.0.0
aurelia-contrib/aurelia-typed-observable-plugin ^2.0.0
bigopon/aurelia-portal-attribute ^2.0.0
bigopon/aurelia-blur-attribute ^2.0.0
zewa666/aurelia-async-binding ^2.1.2
aurelia-ui-toolkits/aurelia-kendoui-bridge ^2.1.1

Non-core (45) on ^1.x.x

Vheissu/aurelia-typescript-plugin ^1.5.0
redeyeapps/aurelia-redeye-design ^1.5.0
aurelia-plugins/aurelia-plugins-password-viewer ^1.7.1
Foursails/aurelia-plus ^1.5.0
aurelia-ui-toolkits/aurelia-syncfusion-bridge ^1.0.4
dtaalbers/au-datatable ^1.2.1
Vheissu/aurelia-google-maps ^1.6.0
ne0guille/aurelia-plugins-google-places-autocomplete ^1.0.9
sketch7/ssv-au-ui ^1.3.0
SpoonX/aurelia-datatable-export ^1.0.0
SpoonX/aurelia-datatable ^1.0.0
heruan/aurelia-persistence ^1.2.1
MeirionHughes/aurelia-template-lint ^1.0.0
aurelia/template-lint ^1.0.0
jdanyow/aurelia-breeze ^1.0.0-rc.1.0.0
Nexbit/aurelia-slideout ^1.0.4
Vheissu/aurelia-modal ^1.0.1
jdanyow/aurelia-computed ^1.0.0-rc.1.0.0
niieani/aurelia-binding-functions ^1.0.0-beta.1.3.0
jdanyow/aurelia-async ^1.0.0-beta.1
Vheissu/aurelia-tabs ^1.0.1
SpoonX/aurelia-pager ^1.0.0
aurelia-plugins/aurelia-plugins-google-places-autocomplete ^1.7.1
aurelia-plugins/aurelia-plugins-google-maps ^1.7.1
heruan/aurelia-components ^1.2.1
Vheissu/aurelia-configuration ^1.6.0
aurelia-contrib/aurelia-knockout ^1.0.0
SpoonX/aurelia-orm ^1.0.0
sidloki/aurelia-onsenui ^1.2.1
justindra/aurelia-facebook-sdk ^1.2.0
aurelia-contrib/aurelia-knockout ^1.0.0
niggoo/aurelia-notifications ^1.2.1
mariaantony-gnanasekaran/aurelia-syncfusion-bridge ^1.0.4
writelinez/aurelia-tinymce ^1.5.0
titou-from-mars/aurelia-tinymce-wrapper ^1.5.0
aurelia-plugins/aurelia-plugins-pagination ^1.7.1
aurelia-plugins/aurelia-plugins-google-recaptcha ^1.7.1
aurelia-plugins/aurelia-plugins-google-places-autocomplete ^1.7.1
aurelia-contrib/aurelia-dynamic-html ^1.0.0
froala/aurelia-froala-editor ^1.0.0
formio/aurelia-formio ^1.5.0

// missing source repo:
aurelia-material-ui ^1.2.1
ferngully-aurelia-tools ^1.0.1
aurelia-froala ^1.0.0-beta.1.0.1
aegis-aurelia-knockout ^1.2.1

1. release aurelia-binding v1.8.0, make sure it's tagged as latest on npmjs registry.
2. update all core packages (7) back to "aurelia-binding": "^1.0.0".
3. reach out to all non-core (7) but on ^2.0.0, to update them back to "aurelia-binding": "^1.0.0".

• note most of them are controlled by core team member.
  4. update cli to use https://github.com/darrenscerri/duplicate-package-checker-webpack-plugin
• this warns user about duplicated packages.

Note: updating core packages back to "^1.0.0 | ^2.0.0" doesn't solve everything, as you need to ask the same for non-core (7) but on ^2.0.0. So why not just upgrade all of them back to ^1.0.0 to simplify dependency.

Update: decision was made to keep v2.

[3cp]

Temporary solution for duplicated aurelia-binding in webpack bundle:

1. use https://github.com/darrenscerri/duplicate-package-checker-webpack-plugin to detect duplicates.
2. using alias to force one version of aurelia-binding

webpack.config.js

const DuplicatePackageCheckerPlugin = require('duplicate-package-checker-webpack-plugin');
// ...
module.exports = ({production, server, extractCss, coverage, analyze} = {}) => ({
  resolve: {
    extensions: ['.js'],
    modules: [srcDir, 'node_modules'],
    // Enforce single aurelia-binding
    alias: {
      'aurelia-binding': path.resolve(__dirname, 'node_modules/aurelia-binding')
    }
  },
  // ...
  plugins: [
    // Detect and warn about duplicates
    new DuplicatePackageCheckerPlugin(),
    new AureliaPlugin(),
    // ...
  ]
});