Miscellaneous fixes and updates

[tripu]

…some of them to adopt Node.js & npm's common/best practices.

• Ignore node_modules/ directory and do not keep it under version control.
• package.json:
  • Native Node.js modules should not be included.
  • Upgrade all other dependencies to latest versions (there were three updates available).
• Node.js 8: include new file type package-lock.json (older versions of Node.js will ignore it).

[iherman]

@tripu, can you explain these changes a bit?

• can a third party easily install the script if the packages are not around? I am not familiar enough with npm, I just followed the npm manuals (I was also surprised to see it installed the built in modules)
• what is this node 8 file? I use nide version 6. Should I switch to version 8?

(The newbie mistakes with npm and node.js)

[tripu]

@iherman, sure, I'll try:

“Can a third party easily install the script if the packages are not around?”

Yes, it can. Those package names I removed from package.json are native to Node.js; included in all distributions. Any package that appears on the API docs is native. It's the first time I see them mentioned explicitly in package.json; I'm sure it's not the recommended way. The npm packages they point to seem either empty placeholders (eg, fs) or (outdated!) copies of the native ones (eg, path). So, definitely better not to have them there.

“What is this node 8 file? I use nide version 6. Should I switch to version 8?”

package-lock.json is a new format introduced in version 8, intended to “lock” all dependencies in an unambiguous, reproducible way. We are still learning to deal with it properly (cf discussion in w3c/specberus#602). We have migrated some of our Node.js tools and servers to 8 already. I think it's good to be on that version, but it's up to you :) When/if we have some automatic testing (#8), we can ask Travis CI to always test every change in both Node 6 and Node 8 (example; see the two “build jobs”), thus making sure the tool remains compatible with both environments.

[iherman]

@iherman, sure, I'll try:

“Can a third party easily install the script if the packages are not around?”

Yes, it can. Those package names I removed from package.json are native to Node.js; included in all distributions. Any package that appears on the API docs is native. It's the first time I see them mentioned explicitly in package.json; I'm sure it's not the recommended way. The npm packages they point to seem either empty placeholders (eg, fs) or (outdated!) copies of the native ones (eg, path). So, definitely better not to have them there.

O.k. What led me on the wrong path is looking at the npm documentation. There is a command that installs things locally and also changes the package.json file, and I did not realize it would blindly do it for packages that are built-in, too. My rookie mistake:-)

“What is this node 8 file? I use nide version 6. Should I switch to version 8?”

package-lock.json is a new format introduced in version 8, intended to “lock” all dependencies in an unambiguous, reproducible way. We are still learning to deal with it properly (cf discussion in w3c/specberus#602). We have migrated some of our Node.js tools and servers to 8 already. I think it's good to be on that version, but it's up to you :) When/if we have some automatic testing (#8), we can ask Travis CI to always test every change in both Node 6 and Node 8 (example; see the two “build jobs”), thus making sure the tool remains compatible with both environments.

Giving some second thoughts I think I would prefer to stay with Node 6. On the node.js site the download of Node 6 is still presented as "Recommended for most users" which I translate that Node 8 is still a bit experimental. Which also means that others who may want to download this script for local use (and I hope some people in the WG do that) may have only Node 6 installed on their local machine.

[tripu]

“Giving some second thoughts I think I would prefer to stay with Node 6.”

Okay. You can still test with both and try to maintain compatibility.

“On the node.js site the download of Node 6 is still presented as "Recommended for most users".”

Yes, it's still four months until version 8 becomes LTS.