Concerto dependency 'semver' not automatically installed

[OliverTod]

The semver module is not automatically installed as part of the concerto-core or concerto-cli install - though it is a required dependency.

This leads to an error message:

which can be resolved by separately installing semver.

[jeromesimeon]

@OliverTod Could you please indicate which version of Concerto you were trying to install?

[OliverTod]

@jeromesimeon I was trying to install v1.1.0

I think the problem is that 'semver' is declared in the concerto-core package.json and concerto package.json but not in the concerto-clipackage.json file.

Only installing the concerto-cli is probably not something the maintainers try very often!

[mttrbrts]

Interesting, looking at the code, I don't see semver used a direct dependency of any concerto-cli module.

What are the steps that you followed, please?

I tried the following ...

$ yarn global add @accordproject/concerto-cli
yarn global v1.22.10
[1/4] 🔍  Resolving packages...
[2/4] 🚚  Fetching packages...
[3/4] 🔗  Linking dependencies...
warning "depcheck > @vue/[email protected]" has unmet peer dependency "[email protected]".
warning " > [email protected]" has unmet peer dependency "typescript@*".
[4/4] 🔨  Building fresh packages...
success Installed "@accordproject/[email protected]" with binaries:
      - concerto
✨  Done in 8.26s.
$ concerto --version
1.1.0
$ concerto          
concerto <cmd> [args]

Commands:
  concerto validate  validate JSON against model files
  concerto compile   generate code for a target platform
  concerto get       save local copies of external model dependencies
  concerto import    import a cto string into its metamodel
  concerto export    export a metamodel to cto syntax

Options:
      --version  Show version number                                   [boolean]
  -v, --verbose                                                 [default: false]
      --help     Show help                                             [boolean]

# Please specify a command

[OliverTod]

Hi Matt - I followed the instructions in the documentation as follows:

$ npm install -g @accordproject/concerto-cli
(node:11577) ExperimentalWarning: The fs.promises API is experimental
npm WARN EBADENGINE Unsupported engine { package: '@accordproject/[email protected]',
npm WARN EBADENGINE required: { node: '>=12', npm: '>=6' },
npm WARN EBADENGINE current: { node: 'v10.15.1', npm: '7.19.0' } }
npm WARN EBADENGINE Unsupported engine { package: '[email protected]',
npm WARN EBADENGINE required: { node: '>=12' },
npm WARN EBADENGINE current: { node: 'v10.15.1', npm: '7.19.0' } }
npm WARN deprecated [email protected]: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
added 51 packages, and audited 52 packages in 10s
4 packages are looking for funding
run npm fund for details
found 0 vulnerabilities
$ concerto
internal/modules/cjs/loader.js:583
throw err;
^
Error: Cannot find module 'semver'
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:581:15)
at Function.Module._load (internal/modules/cjs/loader.js:507:25)
at Module.require (internal/modules/cjs/loader.js:637:17)
at require (internal/modules/cjs/helpers.js:22:18)
at Object. (/Users/Oliver/.nvm/versions/node/v10.15.1/lib/node_modules/@accordproject/concerto-cli/node_modules/@accordproject/concerto-core/lib/introspect/modelfile.js:18:16)
at Module._compile (internal/modules/cjs/loader.js:689:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:700:10)
at Module.load (internal/modules/cjs/loader.js:599:32)
at tryModuleLoad (internal/modules/cjs/loader.js:538:12)
at Function.Module._load (internal/modules/cjs/loader.js:530:3)

I got Martin Halford to verify that he got the same error before I posted this issue. He tried it on node versions 14, 12 and 10 with no luck.

[OliverTod]

The issue went away instantly when I manually installed semver

[martinhalford]

@mttrbrts @jeromesimeon - I can confirm that I got the same error as @OliverTod.
Then ran...
npm install -g semver
...and the problem was resolved.

[jeromesimeon]

My hunch: this may be due to a bug in the latest Concerto release where I used npm audit fix to address some dependency vulnerabilities, but I believe this collides with lerna. I will investigate.

[jeromesimeon]

I can reproduce the error with npm:

zsh-5.8$ npm install -g @accordproject/concerto-cli 
npm WARN deprecated [email protected]: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
/Users/jerome.simeon/.nvm/versions/node/v14.16.1/bin/concerto -> /Users/jerome.simeon/.nvm/versions/node/v14.16.1/lib/node_modules/@accordproject/concerto-cli/index.js
+ @accordproject/[email protected]
added 51 packages from 41 contributors in 9.304s
zsh-5.8$ concerto --help
internal/modules/cjs/loader.js:883
  throw err;
  ^

Error: Cannot find module 'semver'
Require stack:
- /Users/jerome.simeon/.nvm/versions/node/v14.16.1/lib/node_modules/@accordproject/concerto-cli/node_modules/@accordproject/concerto-core/lib/introspect/modelfile.js
- /Users/jerome.simeon/.nvm/versions/node/v14.16.1/lib/node_modules/@accordproject/concerto-cli/node_modules/@accordproject/concerto-core/index.js
- /Users/jerome.simeon/.nvm/versions/node/v14.16.1/lib/node_modules/@accordproject/concerto-cli/index.js
    at Function.Module._resolveFilename (internal/modules/cjs/loader.js:880:15)
    at Function.Module._load (internal/modules/cjs/loader.js:725:27)
    at Module.require (internal/modules/cjs/loader.js:952:19)
    at require (internal/modules/cjs/helpers.js:88:18)
    at Object.<anonymous> (/Users/jerome.simeon/.nvm/versions/node/v14.16.1/lib/node_modules/@accordproject/concerto-cli/node_modules/@accordproject/concerto-core/lib/introspect/modelfile.js:18:16)
    at Module._compile (internal/modules/cjs/loader.js:1063:30)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:1092:10)
    at Module.load (internal/modules/cjs/loader.js:928:32)
    at Function.Module._load (internal/modules/cjs/loader.js:769:14)
    at Module.require (internal/modules/cjs/loader.js:952:19) {
  code: 'MODULE_NOT_FOUND',
  requireStack: [
    '/Users/jerome.simeon/.nvm/versions/node/v14.16.1/lib/node_modules/@accordproject/concerto-cli/node_modules/@accordproject/concerto-core/lib/introspect/modelfile.js',
    '/Users/jerome.simeon/.nvm/versions/node/v14.16.1/lib/node_modules/@accordproject/concerto-cli/node_modules/@accordproject/concerto-core/index.js',
    '/Users/jerome.simeon/.nvm/versions/node/v14.16.1/lib/node_modules/@accordproject/concerto-cli/index.js'
  ]
}

[jeromesimeon]

Probably more simply, semver is listed in the wrong place (devDependencies) in concerto-core:

concerto/packages/concerto-core/package.json

Line 54 in ca338ee

"semver": "7.3.5",

[mttrbrts]

Probably more simply, semver is listed in the wrong place (devDependencies) in concerto-core:

concerto/packages/concerto-core/package.json

Line 54 in ca338ee

"semver": "7.3.5",

That would do it!

[jeromesimeon]

@OliverTod this should now be fixed in Concerto 1.1.1.

Could you please try again with:

npm install -g @accordproject/concerto-cli