Compare dependencies between core and Detroit

[ludtkemorgan]

As part of our ongoing maintenance of the Detroit code base, we would like to keep all dependencies in sync as much as possible to the core repository. This will make it easier to port things over from core as well as making sure that the Detroit code base gets all of the desired security updates.

This ticket is to look at the differences in packages and dependencies between core and Detroit. Including, but not limited to the following:

• All dependencies and devDependencies in backend/core
• All dependencies and devDependencies in sites/public
• All dependencies and devDependencies in sites/partners
• All dependencies and devDependencies in shared-helpers
• Version of Postgres in all deployed backend instances

[ludtkemorgan]

Postgres differences are documented here: bloom-housing#3245. They versions listed there are still up to date

[ludtkemorgan]

This is the current state of Detroit vs Core. I would recommend doing a check again after we have removed detroit-ui-components.

These are the dependencies that are currently lower version in Detroit compared to Core:

• @nestjs/schedule 1.0.2 vs 2.1.0
• @testing-library/dom 7.29.4 vs 9.0.1
• @testing-library/user-event 13.2.1 vs 14.4.3
• class-validator 0.12.2 vs 0.14.0
• Electron 13.3.0 vs 18.3.15
• next 12.3.4 vs 13.2.4
• next-transpile-modules - 8.0.0 vs 10.0.0
• Supertest 4.0.2 vs 6.2.4

Plan for the above:

• We already have a story to update next to 13 which will also update next-transpile-modules
• The rest of the other can be done in one ticket. Most are just for the backend. I would recommend it is done after we remove detroit-ui-components. - Update dependencies to latest  #1618

These are the dependencies that are in Detroit but not in core:

• @mdx-js/loader
• @nestjs/bull (used for redis cron jobs)
• @types/dompurify (Might not be needed anymore)
• Bull (used for redis cron jobs)
• cache-manager-redis-store - might not be needed
• csv-reader - used for import scripts
• ioredis - Core doesn’t use redis anymore
• nestjs-throttler-storage-redis - same as above
• Node-sass - We can probably remove
• Xlsx - used for import scripts

Plan for the above:

• xlsx and csv-reader are used by import scripts that we don't have in core. These do not need to be touched.
• The bull and redis dependencies have been removed by core. We could look into removing those dependencies if we decide to get off of redis. - Investigate redis usage in Detroit #1619
• The remaining two node-sass and mdx-js we should re-look at once detroit-ui-components is removed - Update dependencies to latest  #1618

[ludtkemorgan]

@sarahlazarich can this story be closed? The three stories for resolving the discrepancies are created and have been discussed by the engineering team

[sarahlazarich]

yes!