npm/pnpm install does not show version conflicts

[stefanuebe]

Description of the bug

We have a large application, that defines npm packages using the flow annotation. We had now the case, that (p)npm install had run all the time despite there have been no changes to the npm packages. After some research we found, that there have been two different versions of the same npm package.

While in earlier Vaadin versions npm install had shown warnings for conflicting versions, now it does not anymore neither with npm nor with pnpm.

Expected behavior

Using (p)npm install should show version conflicts.

Minimal reproducible example

1. Create a new app using the Vaadin starter.
2. Create two simple views, with an NpmPackage annotation, e.g. @NpmPackage(value = "tippy.js", version = "6.3.5") on one and @NpmPackage(value = "tippy.js", version = "6.3.7") on the second
3. Do the normal stuff to start the application.
4. The package.json will now show one of the versions.
5. Now exchange the versions in the two views(so .7 to .5 and vice versa)
6. On the next startup the package json will have changed to the other version

Step 5 might seem a bit theoretical, but as Vaadin seem to use the "last" found version, this is necessary to show, how the version seems to be picked randomly from addons / other modules.

Versions

• Vaadin / Flow version: 23
• Java version: 17
• OS version: Windows 10

[caalador]

There should be in the logs the warning level message Multiple npm versions for {} found: {}. First version found '{}' will be considered. it is not in any way dependent on (p)npm and is logged by dependecy scanning.

In development mode this might get lost in the logs as it is run in the dev thread.

Project code should always be scanned first so the annotations from it should override any packages defined in any add-ons or components.

[caalador]

So this is an issue with development mode as there we do not have the duplicate check.
Running a production build with maven on the starter will produce the line [WARNING] Multiple npm versions for tippy.js found: [6.3.7, 6.3.5]. First version found '6.3.7' will be considered. which is not logged when running the application in development mode.

[vaadin-bot]

This ticket/PR has been released with Vaadin 14.8.6.

[vaadin-bot]

This ticket/PR has been released with Vaadin 23.0.3.