fix(agents): drop unused deps, devDeps, and peer deps#1346
Merged
threepointone merged 1 commit intomainfrom Apr 20, 2026
Merged
fix(agents): drop unused deps, devDeps, and peer deps#1346threepointone merged 1 commit intomainfrom
threepointone merged 1 commit intomainfrom
Conversation
- dependencies: remove json-schema, json-schema-to-typescript, picomatch (none are imported; picomatch is transitive of @rolldown/plugin-babel). Dropping json-schema-to-typescript also removes its lodash transitive, resolving the GHSA-p6mc-m468-83gw audit flag from end-user installs. - devDependencies: remove @ai-sdk/openai (only referenced in a commented-out line) and @cloudflare/workers-oauth-provider (unused). - peerDependencies / peerDependenciesMeta: remove @ai-sdk/react and viem. @ai-sdk/react is already declared as a peer of @cloudflare/ai-chat (itself an optional peer here); viem is a regular dependency of @x402/evm, so both flow in transitively when their features are used. Closes #1345 Made-with: Cursor
🦋 Changeset detectedLatest commit: ec9dcae The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
agents
@cloudflare/ai-chat
@cloudflare/codemode
hono-agents
@cloudflare/shell
@cloudflare/think
@cloudflare/voice
@cloudflare/worker-bundler
commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Trim entries from
packages/agents/package.jsonthat were not imported by the package. Closes #1345 by removingjson-schema-to-typescript(which transitively pulled in vulnerablelodash, GHSA-p6mc-m468-83gw) from the runtime dependency tree.dependenciesjson-schema— not imported anywhere.json-schema-to-typescript— not imported anywhere. This also drops the lodash transitive from production installs, resolving json-schema-to-typescript transitive pulls vulnerable lodash into production builds (HIGH advisory) #1345.picomatch— not imported directly; it's already a transitive dep of@rolldown/plugin-babel.devDependencies@ai-sdk/openai— only appeared in a commented-out line inevals/scheduling.eval.ts.@cloudflare/workers-oauth-provider— no references anywhere in the package.peerDependencies/peerDependenciesMeta@ai-sdk/react— not imported directly.@cloudflare/ai-chat(an optional peer) already declares@ai-sdk/reactas its own peer, so users using the chat entry points will be prompted to install it via that package.viem— not imported anywhere (only a JSDoc mention).@x402/evmdeclaresviemas a regular (non-peer) dependency, so it's installed transitively whenever x402 is used.A patch changeset for
agentsis included.Test plan
npm installat the repo root succeeds and reconciles the lockfile.tsc -p packages/agents/tsconfig.json,packages/agents/src/tests/tsconfig.json, andpackages/agents/src/react-tests/tsconfig.jsonall pass with the removals applied.npm ls json-schema-to-typescriptno longer shows it underagentsafter install in a downstream project.Made with Cursor