[Meta] Reducing Kibana bundle sizes

[Bamieh]

I was checking opportunities for us to improve page load perofmance for kibana. This is a meta issue with some of my findings. We can create PRs or separate issues for tackling each one on the list individually. I only looked at package.json dependencies; maybe we can get rid of some devDependencies as well to reduce yarn install time in the future.

Bundle specific changes

Copied from #95853

One of our goals is to keep Kibana fast. A large part of this is to reduce the amount of Javascript that is downloaded and parsed on each page load. We have for some time provided bundle size metrics on pull requests. From the docs:

The size of the entry file produced for each bundle/plugin. This file is always loaded on every page load, so it should be as small as possible. To reduce this metric you can put any code that isn’t necessary on every page load behind an async import().

Code that is shared statically with other plugins will contribute to the page load bundle size of that plugin. This includes exports from the public/index.ts file and any file referenced by the extraPublicDirs manifest property.

• Reduce visTypeTimeseries bundle size #64631
• Reduce visTypeMarkdown bundle size #64638
• Reduce visTypeVega bundle size #64749
• Reduce visTypeTable bundle size #64778
• Reduce security & spaces plugin bundle sizes #64192
• Reduce maps bundle size (code splitting) #64317
• Reduce lens bundle size #64769
• Reduce uptime bundle size #65257
• [Logs UI][Metrics UI] Reduce infra bundle size #89025
• Reduce core bundle size #95890
• Reduce charts bundle size #104697
• [meta] Reduce App Services bundle sizes #112832
  • [data] Reduce data bundle size #84788
  • [KibanaUtils] Reduce kibanaUtils bundle size #114988
  • [KibanaReact] Reduce kibanaReact bundle size #114990

Cross bundle changes

• We have multiple encryption libraries (request-crypto, node-crypto, jsonwebtoken and node-forge) A lot of functionality is shared between these libraries, maybe we can get rid of node-forge in favor of node-crypto)

• We have multiple http fetch libraries: nock, whatwg-fetch, node-fetch, request, load-json-file. Maybe it is worth exploring getting rid of most of those.

• We have multiple glob libraries: glob, glob-all, globby, minimatch. They all have very similar feature set. Maybe we can explore the possiblity of only ussing 1 package.

• We have multiple unique id generation packages: seedrandom, uuid. EUI also provides a helper as well to generate uuids. Maybe we can explore using 1 of them only.

• We have many JSON helper tools: rison-node, JSONStream, deep-freeze-strict, fast-deep-equal, hjson, idx, object-hash, object-path-immutable, set-value. Some of those are only used in 1 place, maybe its worth exploring removing those big libraries.

• We have two unzip libraries: yauzl, tar. Can we remove one of them?

• We have at least five redux-like state management packages. [Discussion] State management tools in Kibana #101253

• remove deprecated intl-relativeformat and update intl-messageformat to the version relying on the global Intl object. [i18n] React-Intl v3 soon out of beta #38642

• font-awesome is no longer used in EUI. Do we have a plan to get rid of it completely?

• We are using the complete lodash + few fp.lodash packages. Maybe we can encourage using the fp.lodash packages to only use what we need?

• We have node APIs usages in client code that are polyfilled and bloat bundles "Buffer" polyfill bloats plugin bundles #107280

• Use packages' target_web builds to ensure browser compatibility (Use target_web to ensure browser compatibility #130874)

Complete

• Webpack and some of its plugins are in dependencies instead of a devDependencies
  (@mistic chore(NA): remove webpack as a prod dependency #88284)

• Get rid of the xregexp regular expressions library (almost 1mb): I believe we can replace it with native regexp since all features needed are supported natively now. (@Bamieh remove xregexp package #91369)

• remove Bluebird in favor of native Promises. Native promises caught up with both performance and features to what bluebird used to offer. (@watson Remove bluebird dependency #118097)

• Angular is going to be killed by google this year in december. What are our plans to completely remove it?

• We have two duplicate deps: statehood (deprecated) and @hapi/statehood. Can we get rid of one? Remove direct dependency on statehood package #93592

• move cheerio as dependency to devDependencies. (@pgayvallet Some package.json cleanup #92136)

• @storybook/addons as a dependency instead of a dev dependency. (@pgayvallet Some package.json cleanup #92136)

• get rid of react-portal since it is not used anywhere. (@pgayvallet Some package.json cleanup #92136)

• get rid of vscode-languageserver since it is not used anywhere. (@pgayvallet Some package.json cleanup #92136)

• Import node-libs-browser polyfills in the @kbn/ui-shared-deps-npm package to avoid importing them in all bundles (@afharo Move node-libs-browser to ui-shared-deps-npm #130877)

Moving packages from dependencies to devDependencies is just for keeping things tidy. Operations filter down unused dependencies before bundling. Feel free to edit this issue ❤️

[elasticmachine]

Pinging @elastic/kibana-core (Team:Core)

[elasticmachine]

Pinging @elastic/kibana-operations (Team:Operations)

[mshustov]

There are lots of packages duplicated in yarn.lock with different versions(see d3, vega, and others).
Is it possible to automate the check that dependency update reduces the number of different versions?

[spalger]

We have a step in kbn bootstrap that inspects the yarn.lock, package.json, etc, and could definitely implement some dedupe validation if we could define the exact criteria we want to implement. I'm in favor of keeping a list of dependencies which we explicitly want to limit like we've done for lodash

[Bamieh]

I've created a PR to remove xregexp dependency from the codebase (#91369)

[mshustov]

@Bamieh are there any plans to remove deprecated intl-relativeformat and update intl-messageformat to the version relying on the global Intl object?

[Bamieh]

@restrry yes! I have an issue for upgrading those in the backlog. I'll add it to the list above too 👍

[mshustov]

@Bamieh Some code still uses Bluebird we can migrate to native Promises instead

[Bamieh]

@restrry added to the list. Native promises caught up with both performance and features to what bluebird used to offer.

[Bamieh]

I've created a PR to remove bluebird dependency from the codebase (#95191)

[watson]

I took a stab at removing bluebird in main: #118097

[watson]

Bluebird removed ✅

[Bamieh]

@watson you're awesome :) thanks

[vadimkibana]

AppServices is the main user of rison-node.