Browserify-aes

[jopit]

The browserify-aes package that gets pulled in by Theia is listed as being licensed under the MIT license, but this issue indicates that package may in violation of other licenses.

Does Theia actually use browserify-aes? Could the dependency on it be removed?

[svenefftinge]

It comes through webpack, which is required by the application-package:

> yarn why browserify-aes
yarn why v1.3.2
[1/4] 🤔  Why do we have the module "browserify-aes"...?
[2/4] 🚚  Initialising dependency graph...
[3/4] 🔍  Finding dependency...
[4/4] 🚡  Calculating file sizes...
info Reasons this module exists
   - "workspace-aggregator-3a78d219-b5dd-42a0-88b7-0bb6370469db#@theia/application-package#webpack#node-libs-browser#crypto-browserify#browserify-cipher" depends on it
   - "workspace-aggregator-3a78d219-b5dd-42a0-88b7-0bb6370469db#@theia/application-package#webpack#node-libs-browser#crypto-browserify#browserify-sign#parse-asn1" depends on it
info Disk size without dependencies: "96kB"
info Disk size with unique dependencies: "300kB"
info Disk size with transitive dependencies: "464kB"
info Number of shared dependencies: 8
✨  Done in 0.92s.

[jopit]

Does Theia actually need (make use of) the function in browserify-aes itself, or is just pulled in because it's part of a package containing other function that Theia needs?

[svenefftinge]

It is pulled in through the extension-manager extension, which uses application-package, which uses webpack, which has a dependency node-libs-browser->crypto-browserify->browserify-cipher.
I know that webpack is used at runtime, to update a theia app ((un)installing extensions). I don't know if webpack actually really requires the dependencies above in our use case.

[svenefftinge]

For now, you could remove the extension-manager extension from your theia app, to get rid of the dependency.

[jopit]

Our package.json doesn't include the extension-manager extension, but application-package still gets built into our theia app.

{
    "private": true,
    "dependencies": {
        "@theia/typescript": "^0.3.7",
        "@theia/navigator": "^0.3.7",
        "@theia/terminal": "^0.3.7",
        "@theia/outline-view": "^0.3.7",
        "@theia/preferences": "^0.3.7",
        "@theia/git": "^0.3.7",
        "@theia/file-search": "^0.3.7",
        "@theia/markers": "^0.3.7",
	"@theia/java": "^0.3.7"
    },
    "devDependencies": {
        "@theia/cli": "^0.3.7"
    }
}

Is there some other extension that's also pulling it in? The docker hub theiaide/theia image also contains application-package although it's package.json doesn't include extension-manager

[epatpol]

@svenefftinge I believe the @theia/cli dev-package pulls it even though extension-manager isn't there.

[jopit]

Forgive my node/yarn ignorance, but is it OK to remove devDependencies, will yarn still build our theia app?

[svenefftinge]

You can remove the devDependencies after you've successfully built the application.
Note that you need to start Theia through node src-gen/backend/main.js then.

[jopit]

Awesome, thanks

[kittaakos]

@jopit, is there anything else left we have to discuss here? If no, I would like to close this issue. Thanks!

[jopit]

We are good for now, so closing this.