joshperry / grunt-package-modules

Grunt plugin to packages node_modules dependencies at build time for addition to a distribution package

grunt-package-modules

Packages node_modules dependencies at build time for addition to a distribution package.

Checking node_modules in to source control is a lame solution to locking dependencies for a certain commit. npm shrinkwrap is great for locking dependencies to specific commits but doesn't directly help with distribution packaging.

The node_modules folder that is used for building your project is not viable for dist packaging because it will contain dev dependencies (like this grunt plugin) and can also contain host-specific binary node modules.

This task takes care of creating a fresh node_modules for including in a distribution tarball by effectively copying the package.json into a temp directory, and then executing npm install --production --ignore-scripts --prefix tempdir/ to install all production deps into tmpdir/node_modules.

This directory can then be the source of another plugin, like copy or compress, to package the fresh node_modules into its delicious-looking retail packaging.

This is a great module to use with the concurrent plugin so that the node modules will download while other parts of your packaging flow are executing (sassing, lessing, uglifying, compiling, and other transformation plugins verbified).

Getting Started

This plugin requires Grunt ~0.4.5

If you haven't used Grunt before, be sure to check out the Getting Started guide, as it explains how to create a Gruntfile as well as install and use Grunt plugins. Once you're familiar with that process, you may install this plugin with this command:

npm install grunt-package-modules --save-dev

Once the plugin has been installed, it may be enabled inside your Gruntfile with this line of JavaScript:

grunt.loadNpmTasks('grunt-package-modules');

The "packageModules" task

Overview

In your project's Gruntfile, add a section named package_modules to the data object passed into grunt.initConfig().

The src is the package.json that describes the dependencies that should be packaged up. The dest is the destination directory where the fresh node_modules directory should be placed, this is usually a temp directory.

grunt.initConfig({
  packageModules: {
    dist: {
      src: 'package.json',
      dest: '.tmp/module_packaging'
    },
  },
});

Examples

Here is an example that uses the copy and compress plugins to send the packaged modules to a dist tarball:

grunt.initConfig({
  packageModules: {
    dist: {
      src: 'package.json',
      dest: 'dist'
    },
  },
  copy: {
    dist: {
  	  files: [{
		// Copy project files to dist dir
        expand: true,
        dest: 'dist',
        src: [
          'lib/**/*'
        ]
      }]
    },
  },
  // tarball all the files in the dist dir into proj-dist.tar.gz
  compress: {
    dist: {
      options: {
	    archive: 'dist/proj-dist.tar.gz'
	  },
	  files: [{
	    expand: true,
		dot: true,
		cwd: 'dist',
        src: '**/*'
      }]
    }
  },
});

Contributing

In lieu of a formal styleguide, take care to maintain the existing coding style. Add unit tests for any new or changed functionality. Lint and test your code using Grunt.

Release History

v0.1.0 Initial Release

To Do

• Tests
• Possibly add support for npm shrinkwraping

grunt-package-modules's Issues

Fatal error: Refusing to install [module name] as a dependency of itself

I'm trying to use this package to gather my npm_module dependencies for a bundled deployment but ran into the error:

Fatal error: Refusing to install test as a dependency of itself

This error typically occurs when the name of the project also appears in the list of dependencies in package.json, but that's not the case in the original file or the one that is copied into the dist folder.

I was able to get this error with the simplest project setup I could create from the examples given in the grunt tutorial and the package wiki. Is there something I'm missing in setting up this plugin?

package.json

{
"name": "test",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo "Error: no test specified" && exit 1"
},
"author": "",
"license": "ISC",
"dependencies": {
"underscore": "^1.8.3"
},
"devDependencies": {
"grunt": "^1.0.1",
"grunt-package-modules": "^1.0.0"
}
}
Gruntfile.js

module.exports = function(grunt) {
grunt.initConfig({
packageModules: {
dist: {
src: 'package.json',
dest: 'dist'
},
}
});
grunt.loadNpmTasks('grunt-package-modules');
}

Security Issue

https://nvd.nist.gov/vuln/detail/CVE-2019-16775

This grunt-package-modules have security issue of CVE-2019-16775 due to NPM Version 3 dependency, Npm should be upgraded to 6.13.3 or later version to fix this problem.