Historically, we've manually copied our third-party JavaScript to our

tree, bundling it when building packages via Django Pipeline. This

worked fine, but it was extra stuff in our tree, and wasn't particularly

fun to maintain.
With the major upgrade to our JavaScript tooling in Review Board 6,

we're finally able to modernize this.
Now, our lib bundles (3rdparty-base, 3rdparty, and

3rdparty-jsonlint) import straight from node_modules. The applicable

packages come from Review Board's package.json or from Djblets's

(which is now set up as a "workspace", which helps treat Djblets'

dependencies as our own).
We mostly are using the same versions we previously specified. Some got

bumped up to new .z versions, and jsonlint had to be replaced with a

modern (but compatible) fork, but otherwise there aren't any significant

changes. Major version bumps would happen separately.
Some dependencies couldn't be bundled this way. Neither the jQuery-UI

packages nor Jasmine are built in a way that lets us consume them via

imports without a lot of extra maintenance, So we continue to ship them

and bundle them the way we did before. However, they've been moved into

new per-bundle namespaced directories.
To facilitate all this, rollup.config.js has been updated to handle

multiple categories of build targets. The 3rdparty-base bundle gets

its own configuration, built to consume the two packages we need

(babel-polyfill and jquery). The 3rdparty bundle is for all the

remaining packages in libs. And the last bundle is for all our code in

Review Board and Djblets. The right bundle is selected based on input

path, by using Rollup's ability to return results based on command line

arguments (since we pass the file paths to Rollup).
This also officially introduces our new Spina library as a dependency,

with Spina's Backbone TypeScript support enabled.

Cleared out node_modules, installed new packages.
Tested various pages on the site and ran unit tests successfully.

(There are some failures, but those are fixed and will be posted

separately.)
Successfully built new Review Board packages.
Manually inspected unminified versions of the resulting bundles,

making sure the contents were as expected and there weren't any

duplicate modules bundled in.