use peerDependencies instead of dependencies for express, koa, ...

[kapouer]

You actually do not want to install express, for example - but peerDependencies allows one to check the installed version of express is compatible.

[simov]

Hi, @kapouer thanks for suggesting this. I have never used peerDependencies so far, but I agree that Grant can't be used without it's host modules. I'll consider using this option.

[simov]

I did some testing with peerDependencies and I don't think they quite work for this case.

Currently I use Grant in project that uses express version 3.4.4 and it works without a problem. In case of a peer dependency I won't be able to install Grant if the peer dependency is set to 4.x. On the other hand I really do need to specify express 4.x because that's what I'm testing against.

Same for the other 4 express middlewares that I use, if only one of these modules is added as a dependency to the consumer project and have a version mismatch, the install will fail.

No idea how's the situation with different versions of Koa, but then again I'm actually requiring these modules inside the Koa consumer implementation.

Recently I added support for Hapi, and that's the only consumer module I'm not requiring directly in my code.

[simov]

@kapouer this should be fixed in https://github.com/simov/grant/releases/tag/3.0.0 or at least that way you'll get only the modules required for your web framework of choice.

[kapouer]

perfect !

[simov]

@kapouer checkout the latest changelog here https://github.com/simov/grant/blob/master/CHANGELOG.md - express, koa and hapi are set as peerDependencies in their respective meta modules, also session and body-parser middlewares are no longer required internally, so the user is free to use any session store.

[sylvainlap]

npm3 no longer install peerDependencies. Is there a workaround ?

[simov]

NPM3 shifts the responsibility for fulfilling peer dependencies from library framework / plugin maintainers to application authors, in that line of thinking you now just get a warning if the dependency is missing.

As a consumer of this module you are responsible for specifying in your package.json which version of Koa your app/module is going to use. Essentially almost nothing have changed, you just have to make sure you explicitly specify Koa as dependency in your app.

[sylvainlap]

ok thanks