deps(client): bump bpmn-io dependencies

[pinussilvestrus]

• @bpmn-o/properties-panel@0.20.0
• bpmn-js@9.4.0
• bpmn-js-properties-panel@1.6.0
• bpmn-moddle@9.4.0
• camunda-bpmn-js@0.17.0
• camunda-bpmn-moddle@7.0.1
• diagram-js@8.9.0
• zeebe-bpmn-moddle@0.15.0

---

Closes #2994
Closes #3085

[pinussilvestrus]

Something is going on with preact-markup : https://github.com/camunda/camunda-modeler/runs/8183836279?check_suite_focus=true#step:6:391

ERROR in ../node_modules/preact-markup/dist/preact-markup.module.js 1:0-42
Module not found: Error: Can't resolve 'preact' in '/home/runner/work/camunda-modeler/camunda-modeler/node_modules/preact-markup/dist'

[pinussilvestrus]

@barmac do you maybe have an idea? Neither preact nor preact-markup were updated.

[barmac]

I'll have a look at this.

[barmac]

Let's re-run the tests first ⏳

[barmac]

OK so it still fails. What is more, I can reproduce the issue on my machine.

Preact-markup peer-depends on preact and until now it used the preact installed via the form-viewer.

I noticed that on my machine preact-markup is eventually placed in the root node_modules while preact stays in client/node_modules. This may be the reason why it fails. Let's check if removing lerna bootstrap helps.

[barmac]

It does not :(

We need to somehow make sure that preact-markup is installed in the same node_modules or a level below preact. That should fix the issue.

[pinussilvestrus]

We could add preact-markup as a dependency of client, that would fix the issue.

However, I wonder why this doesn't happen during install of bpmn-js-properties-panel. Probably related to the npm@8/lerna@5 upgrade?

[barmac]

We could add preact-markup as a dependency of client, that would fix the issue.

However, I wonder why this doesn't happen during install of bpmn-js-properties-panel. Probably related to the npm@8/lerna@5 upgrade?

This is super weird, because we don't use --hoist 🤯 . Also, preact-markup is a client-only dependency, so there's no reason for the tool to hoist it.

[pinussilvestrus]

Fixed via 0f1d435. A reinstall seemed to do the trick.

This is ready to review now.

[pinussilvestrus]

It seems like upgrading to npm@8 and lerna@5 led to some surprises when installing dependencies (also cf. bpmn-io/form-js#325 (comment)). I discussed this with @barmac and agreed to talk about this with the team in one of our next weeklies. ⚡

[barmac]

I tested this locally and it works correctly. As a follow-up, we should also fix or look into the detected vulnerabilities: 33 vulnerabilities (3 low, 13 moderate, 16 high, 1 critical) .

[pinussilvestrus]

I will follow up with some audit clean-ups.