Ignore devDependencies version mismatch in bootstrap

[derek-ho]

Is your feature request related to a problem? Please describe.

Security dashboards plugin was recently cut a ticket for a build failure: opensearch-project/security-dashboards-plugin#1682 (comment). Locally, matching the version in package.json solves this type of issue, but not sure if this is scalable long term, and especially for devDependencies matching the version should matter less?

Describe the solution you'd like

Ignore/skip/provide some other long term solution for dependency resolution/matching

Describe alternatives you've considered

A clear and concise description of any alternative solutions or features you've considered.

Additional context

Add any other context or screenshots about the feature request here.

[derek-ho]

@kavilla / @ashwin-pc I saw that there was some discussion about this before, but I wasn't able to find a resolution - can you advise here on if there is a fix from core side or we should just try to manually match the package.json versions?

[abbyhu2000]

#3095 I found this RFC on decoupling the dependency.

[derek-ho]

Thanks, @abbyhu2000, @AMoo-Miki! Would it be feasible to fix this from dashboards side in near term, or should I still open issues in individual plugin repos to manually match the versions?

[wanglam]

@derek-ho According the opensearch-build script, it will remove the success build plugin folder if everything goes well. According the build log, the root cause was dashboards-reporting build failed due to failed to run yarn osd bootstrap. I think we need to fix this issue first.

[ashwin-pc]

@AMoo-Miki 's PR #5675 should allow for less restrictive version requirements.

[derek-ho]

@ashwin-pc @AMoo-Miki any updates on this issue long term? We started seeing failures on bootstrap on main again:

[1/4] Resolving packages...
[2/4] Fetching packages...
[3/4] Linking dependencies...
warning "@elastic/eslint-import-resolver-kibana > eslint-import-resolver-webpack@0.13.8" has unmet peer dependency "eslint-plugin-import@>=1.4.0".
warning " > @testing-library/react-hooks@7.0.2" has unmet peer dependency "react@>=16.9.0".
warning "@testing-library/react-hooks > react-error-boundary@3.1.4" has unmet peer dependency "react@>=16.13.1".
warning "cypress-mochawesome-reporter > mochawesome@7.1.3" has unmet peer dependency "mocha@>=7".
warning " > eslint-plugin-cypress@2.15.1" has unmet peer dependency "eslint@>= 3.2.1".
[4/4] Building fresh packages...

ERROR [single_version_dependencies] Multiple version ranges for the same dependency
      were found declared across different package.json files. Please consolidate
      those to match across all package.json files. Different versions for the
      same dependency is not supported.

      If you have questions about this please reach out to the operations team.

      The conflicting dependencies are:

        cypress
          9.5.4 => opensearch-dashboards
          ^13.6.0 => opensearch-security-dashboards

Any suggestions on path forward to unblock the CI/autocuts?

[derek-ho]

Update: adding --single-version=loose as suggested in the linked PR fixed the bootstrapping process on local CI. Opensearch-build is not passing in this param, and until it is done so autocuts will be cut. Not sure what the process forward for this issue is, but ideally this parameter shouldn't be needed for devDependencies.

[peternied]

@ashwin-pc @AMoo-Miki Could you take a look at a pull request [1] in opensearch-build to make this the default for the distribution build process?

• [1] Add single version loose param for building plugins opensearch-build#4468

[AMoo-Miki]

OSD 2.12 shipped with #5675. Infra will take care of the PR on the build repo.