Gridstack requires whole lodash

[piernik]

Gridstack imports whole lodash. I suppose Your'e using only few functions. Can You make some adjustements so that not whole lodash will be imported?

[JohnArcher]

#980 removed the lodash dependency completely. But this is "just" in the develop branch currently.

[piernik]

When can we expect new version?

[creage]

Pinging @radiolips here - any ETA on releasing lodash-free version?

[creage]

BTW, here is my solution to shrink the size of lodash required by gridstack. Since I'm using webpack for building my project, it allows me to replace a dependency with custom script, using NormalModuleReplacementPlugin.

First, we need a custom build of lodash, with required modules/functions only. So I went through the code of gridstack, and extracted all of them. Next, using lodash-cli we can create our custom build:

lodash include="bind,chain,clone,defaults,each,filter,find,first,isString,map,max,reduce,sortBy,take,throttle,value,without" -d

This will produce a js script with listed functions only, which is much smaller than the whole library.

Now, we need to feed it to gridstack. Add a new entry into your plugins collection of webpack configuration:

...
plugins: [
// feed custom lodash build to Gridstack, to minimize assets size
	new webpack.NormalModuleReplacementPlugin(/lodash/, function (resource) {

		if (~resource.context.indexOf('gridstack') && resource.userRequest) {

			const map = {
				find: /client\\node_modules\\lodash\\lodash/,
				replace: 'client\\sources\\App\\vendor\\gridstack\\_'
			};

			resource.request = resource.request.replace(map.find, map.replace);
			resource.userRequest = resource.userRequest.replace(map.find, map.replace);
			resource.resource = resource.resource.replace(map.find, map.replace);
		}
	})
]

I saved my custom build with _.js name, and placed it into sources\App\vendor\gridstack project folder.

It kinda works, the only issue is the lodash-cli contains old version of lodash, despite having latest installed. And this old version is considered vulnerable https://snyk.io/vuln/npm:lodash?lh=4.17.5

So I'm still looking forward to get lodash-free version.

[radiolips]

@creage @piernik I'm hoping to get the dev version released today! Worst case should be tomorrow.

[adumesny]

@creage whoa, that's a lot of work! thankfully the 0.5.0 lodash free version (and bunch of fixes) I made should be out tomorrow. Stay tune!

[adumesny]

I just published v0.5.0 which has that removed. enjoy!