This is more of a task to think/discuss about first. Other tasks might fall out of it.

Basically, there are situations where we want to ensure that the dependency version of specific NPM packages are the same across HPIs.

We actually already have a mechanism to do this (in spite of some common misconceptions ) via js-modules import @any, which tells js-modules at runtime that a bundles runtime dependency can be satisfied by "any" version of that package that's already registered with js-modules. By using that + ensuring that our bootstrap bundle (blueocean.js via blueocean-web HPI) exports the version it uses (the "right" version), then we can make sure all bundles use the same version of these packages at runtime (even if their package.json files declare deps on different versions). Maybe we can improve this some more.

The trick here though is that this needs to be thought out and configure beforehand. We need to understand what NPM packages we need to do this with etc. We can't just do it magically or by handwaving ... we need to know exactly which packages this needs to happen for etc e.g. react, mobx, xyz etc.

So, there will always be situations where we are using packages and then (some time later) discover that we need to manage the dependency of that package (someone writes a plugin using the same package and things start going wrong because there are multiple/conflicting versions in play). If that happens, it's not because "the toolchain is completely broken" ... it's because there's more to using that package than was originally though and we probably need to make core changes to ensure that we "manage" the runtime loading of that package in a way that doesn't cause things to explode. There's no silver bullet here for situations like this ... we're talking about Javascript engines and third party libs that were never designed to run in a plugin system like we're creating (and that includes react). We're not talking about OSGi, where everything is automatically isolated from each other (which can be a big pain in the ass too).