package.json contains different packages when generated by dev server or vaadinBuildFrontend

Hey, I am debugging strange behaviour in our app, where the contents of package.json is different when it is generated by the dev server or by the gradle task vaadinBuildFrontend (and thus by our CI server).
I figured out, that the DevModeClassFinder does not find all classes the ReflectionsClassFinder finds, but now I am not sure where to continue…

We have a direct dependency on com.github.appreciated:vaadin-css-grid which itself depends on org.vaddon:mediaquery. Mediaquery has some @NpmPackage annotations, that are not found by DevModeClassFinder but by ReflectionsClassFinder. Consequently, the packages listed by these annotations are there are the difference between the package.json files generated in dev mode or by the gradle task.

Does someone have a pointer for me where to look further?

PS: I tried reproducing this with vaadin starter, but there everything works, and according to the debugger, also both scanners find the same annotations in this method com.vaadin.flow.server.frontend.scanner.FullDependenciesScanner#discoverPackages

Did you Whitelist the addon package?

If dev mode finds more classes, I would say you have whitelisted some packages but not that one. But you are saying it is the other way around?

No, I’ll try

Dev-Mode finds less packages than the other one

Ok, after whitelisting and if git doesn’t lie to me, then now package.json is the same regadless of whether I used the dev-server or the gradle task. Thanks :slightly_smiling_face:

Is this intentional, that whitelisting does not (completely) affect the gradle task?

Sounds more like a bug in Gradle plugin :sweat_smile: it’s probably not as good as the maven one

Ah no. I just found that in the docs:

whitelisted-packages is a comma-separated string that can be used to specify the only packages that need to be scanned for UI components and views.

so it is just performance improvement for development, and not a security thing :slightly_smiling_face:

The docs are probably not correct there :wink:

That sounds like I should try to reproduce this and file an issue…