Move npm dependencies inside src and add CodeMirror to them

[ficristo]

Alternative to #12963
I was wondering if, instead of this approach, we could use some other tool to copy node_modules like using browserify, webpack or others.

Ref #12940

[zaggino]

Yeah, definitely prefer this one over all the others. Only thing that bothers me a little bit is the generation of npm-shrinkwrap file since you need to do that from src folder AND not to forget about it 👍

[petetnt]

I'd be in for using yarn to automatically generate yarn.lock files instead npm-shrinkwrapping.

https://yarnpkg.com/en/docs/yarn-lock

[zaggino]

That'd mean introducing another tool, we'd have to use yarn instead of npm install, not sure how yarn works with npm install scripts... to be honest I don't think yarn is worth the complexity it adds.

[petetnt]

I agree with introducing another tool being cumbersome, but it's a tool that's fully compatible with npm and pretty much improvement in every way (especially with speed and security), especially if we need to fiddle around with npm-shrinkwrap which is basically somewhat broken at this point.

For the grunt script the work needed would be basically s/npm install/yarn, plus with enforcing --pure-lockfile we could ensure that right deps would always be installed.

Disclaimer: I have only used yarn after it came out and I am a huge fan 😸 Not saying that we would need to do it right now (or ever), we can punt it into an issue and think about it later too 👍

[zaggino]

I think this is the best approach from the three we tried.
If we have problems with shrinkwrap, we can introduce yarn later.
For now merging this 👍