Unpin dev dependency "follow-redirects"

[mikeharder]

Dev dependency follow-redirects was pinned to version 1.11.0 in #9609 as a temporary workaround:

• follow-redirects@1.12.0 adds a peer dependency on debug
• http-proxy@1.18.1 depends on follow-redirects@^1.0.0, but does not depend on `debug, which causes an error due to missing peer dependencies

If this issue is fixed in either follow-redirects or http-proxy, we should be able to just unpin the dependency and run rush update --full.

If the issue is not fixed in these packages, we can instead add a dev dependency on debug to all our packages which transitively depend on follow-redirects. This should be all the packages which depend on karma (karma -> http-proxy -> follow-redirects).

PR to add dev dependency "debug": #9608

Related: follow-redirects/follow-redirects#135, http-party/node-http-proxy#1460

[RubenVerborgh]

causes an error

Isn't it a warning though?

[mikeharder]

Isn't it a warning though?

Our repo is configured to treat missing peer dependencies as an error rather than warnings:

https://pnpm.js.org/en/npmrc#strict-peer-dependencies

Even if this was just a warning rather than an error, we also have a policy that our builds must be warning-free.

If http-proxy decides to add a dependency on debug (http-party/node-http-proxy#1460) this will unblock our repo. If not, we will add a dev dependency on debug to all our packages which now need it.

[RubenVerborgh]

Fair enough; I'd personally think it's not up to http-proxy to do it, as they might not be able to commit to the desired version of debug by the software that is using it. (Although they likely could, given that their package.json only commits to Node 8 and up.)

PS I do appreciate the detailed reporting in all 3 involved repositories, this is really helpful.

[RubenVerborgh]

The peer dependency issue is resolved in follow-redirects@1.12.1.
Thanks again for the clear explanations and helpful suggestions! It's so much easier to do the right thing when people take the time to detail their concerns.

[mikeharder]

@RubenVerborgh: Thank you as well for the quick turnaround. I am testing follow-redirects@1.12.1 in our repo right now.

[mikeharder]

Confirmed that follow-redirects@1.12.1 fixes our repo.