Ensure the different generated packages are using the same transitive dependencies

[cprecioso]

Currently, we have no mechanism to ensure that transitive dependencies are the same across the different packages of a Wasp app (user code, generated sdk, server, and client).

For example, in #2672, the following version mismatch was creating a typechecking error in the todo-typescript example:

todo-typescript $ npm why engine.io
engine.io@6.5.4
node_modules/engine.io
  engine.io@"~6.5.2" from socket.io@4.7.5
  node_modules/socket.io
    socket.io@"^4.6.1" from wasp@1.0.0
    .wasp/out/sdk/wasp
      wasp@1.0.0
      node_modules/wasp
        wasp@"file:.wasp/out/sdk/wasp" from the root project

todo-typescript $ (cd .wasp/build/server && npm why engine.io)
engine.io@6.6.4
node_modules/engine.io
  engine.io@"~6.6.0" from socket.io@4.8.1
  node_modules/socket.io
    socket.io@"^4.6.1" from the root project

Important

Please note that both packages request socket.io@^4.6.1, but one is installing socket.io@4.8.1, and the other socket.io@4.7.5.
Added by @sodic: take care of the this TODO when you fix the issue.

This happens because the package-lock.json from the server is being regenerated on each build, so it picks up new versions, but the one from the user code isn't, so it's stuck in the old one.

We need a mechanism to share dependencies, to ensure that such situation doesn't happen.

[cprecioso]

A possible solution would be #1653. Another could be to add the SDK as a dependency of the server and client, to ensure that its dependencies would be taken into account when resolving the dependency tree, and thus would share them when appropriate.

[Martinsos]

To some degree also related to #559 (although that is really about production, not dev, but some similar concepts possibly).

[sodic]

Came here to link #1653 and #1838 work but I see Carlos already did that :D

We really should make that issue the top priority. Its Page rank score across all our communication platforms is probably off the charts.

[cprecioso]

We've been using Vite 6 all along because of this issue:
https://www.notion.so/wasp-lang/Error-writeup-Browser-error-on-blank-project-20018a74854c80249e83ec893c7d6d91?pvs=4

[sodic]

This issue also silently updated us to Vite 7 and, since Vite 7 didn't support all the versions of Node we claim to support, Wasp was broken for some of our users.

We fixed it by pinning down the dependency responsible for including Vite in the web app project: #2865
But we should take care of the core issue as soon as possible.