Fix theme development on Windows using cross-env

[SharakPL]

Questions	Answers
Branch?	develop
Description?	cross-env is required to enable development on Windows
Type?	improvement
Category?	FO
BC breaks?	no
Deprecations?	no
Fixed ticket?	Fixes #22511.
How to test?	npm i and npm run build on Windows
Possible impacts?

---

This change is 

[matks]

Hi @SharakPL I dont think the package-lock.json should be modified, with 39643 changes in it 😅 ?

[SharakPL]

It's not like I modified it. I simply added cross-env. I guess Node 14 changed lock file structure, but it still should work in previous Node versions.

[matthieu-rolland]

The issue related to this PR has been closed 🤔

[NeOMakinG]

I think this is a good idea, wdyt about it @PierreRambaud ?

[PierreRambaud]

cross-env tool is abandonned, the repository has been archived on GitHub.
It's a good idea, but not with this tool :)
Otherwise you're still able to use Git Bash for windows, it does the job

[SharakPL]

cross-env tool is abandonned, the repository has been archived on GitHub.
It's a good idea, but not with this tool :)
Otherwise you're still able to use Git Bash for windows, it does the job

It works fine and it will get fixed if necessary and it's still better than forcing Git Bash on Windows.

[NeOMakinG]

will get fixed

But the simple fact that it's repository is read-only means that the author can't push anymore on it, then we won't accept an npm module without knowing what's inside the module, this is pretty risky in term of maintainability and security

Don't we have alternatives?

[SharakPL]

we won't accept an npm module without knowing what's inside the module, this is pretty risky in term of maintainability and security

Over 3.6 mln weekly downloads and still growing despite being archived. Isn't it enough? Simple tools that work perfectly don't require constant maintanance.

Don't we have alternatives?

Couldn't find any. If someone knows better solution, please let me know.

[PierreRambaud]

cross-env tool is abandonned, the repository has been archived on GitHub.
It's a good idea, but not with this tool :)
Otherwise you're still able to use Git Bash for windows, it does the job

It works fine and it will get fixed if necessary and it's still better than forcing Git Bash on Windows.

All scripts inside PrestaShop source are designed to work under a Bash/Shell system, this is why we recommend you to install Git Bash like you have to install Apache/Nginx, MySQL, and PHP to make it work.
At least with Git Bash, you will be able to run all commands and not only related to assets.

Over 3.6 mln weekly downloads and still growing despite being archived. Isn't it enough? Simple tools that work perfectly don't require constant maintenance.

He archives his repository, so no one can contribute, create an issue, or a pull request, this means we can't trust only one user.
The weekly downloads mean nothing, a lot of old or new packages can relate to it without using it and increase the download amount.

[SharakPL]

@PierreRambaud

He archives his repository, so no one can contribute, create an issue, or a pull request, this means we can't trust only one user.
The weekly downloads mean nothing, a lot of old or new packages can relate to it without using it and increase the download amount.

This I really don't understand. You're so against using a simple tool only to improve development that has just been archived (for personal reasons! tool is just as useful and safe as it has been last couple years), but you're ok with using Bootstrap 4-alpha (yes, I know why this won't change) or Webpack 2 (this should) and other old modules with dozens of vulnerabilities impacting all stores using classic theme. I'm pretty sure you won't be able to create an issue or pull request for them either 😉 All you can do is upgrade your config. I'm on it too...

[matks]

@PierreRambaud

He archives his repository, so no one can contribute, create an issue, or a pull request, this means we can't trust only one user.
The weekly downloads mean nothing, a lot of old or new packages can relate to it without using it and increase the download amount.

This I really don't understand. You're so against using a simple tool only to improve development that has just been archived (for personal reasons! tool is just as useful and safe as it has been last couple years), but you're ok with using Bootstrap 4-alpha (yes, I know why this won't change) or Webpack 2 (this should) and other old modules with dozens of vulnerabilities impacting all stores using classic theme. I'm pretty sure you won't be able to create an issue or pull request for them either 😉 All you can do is upgrade your config. I'm on it too...

The difference between PrestaShop uses cross-env and PrestaShop uses Bootstrap 4-alpha or Webpack2 is very simple.

Today we dont use cross-env. If we dont introduce it, this will break no modules, no themes, no integration. This does not break our Compatibility promise.

Today we use Bootstrap 4-alpha and Webpack2. If we remove or upgrade them, we will break modules, themes, integrations and we will break our Compatibility promise.

PrestaShop is a open source CMS. Developers build other products on it: modules, themes, integrations... and shops (they use PS as a base and add their own logic). Developers expect 3 main things from us:

• Compatibility: they don't want to rewrite their code everytime we release a new version
• Extensibility: they want standard, flexible and robust ways to extend PS (= hooks) to add their own behaviors
• Security

We wish we could remove these old outdated dependencies and it is heartbreaking that we cannot do this until the next major version. But we also know that such a change can simply kill a CMS. We have learned from our past failures and the failures of other CMS which attempted such breaking changes. Trust me, I think the core developers of PrestaShop are the people who want the most to get rid of Bootstrap 4-alpha.

other old modules with dozens of vulnerabilities impacting all stores using classic theme

If you believe you have found a vulnerability that can be exploited against PrestaShop, please report it through our Bug Bounty Program but please be assured we try our best to make sure that even if these dependencies are outdated, and we know it, the known vulnerabilities cannot be exploited against PrestaShop. Let's not forget that a lot of shops dont care about Classic Theme and just put their own theme on it 😅 .

[SharakPL]

@matks so you're saying upgrading webpack and other modules (besides bootstrap and its dependencies) is also impossible for classic theme in current build?

[PierreRambaud]

@matks so you're saying upgrading webpack and other modules (besides bootstrap and its dependencies) is also impossible for classic theme in current build?

Yes, this is currently impossible because of that. 😓
This is also why we are thinking about creating a new theme besides the classic theme, with the latest available tools.

[matks]

Following @PierreRambaud answer I am sorry but I close this PR. We thank you for your contribution but we prefer not to include cross-env as it is abandonned, the repository has been archived on GitHub.