remove unused dependencies

[turadg]

incidental

Description

Prompted by,

• refactor(memoize): depend on harden, not ses #3107

Knip does a more reliable analysis of what's used or not.

This adds a script to verify there are no unused dependencies in the package.json. It skips devDepedencies since those don't generally affect package consumers.

This doesn't go into CI but it could.

Security Considerations

hygiene, avoid unused deps

Scaling Considerations

none

Documentation Considerations

none

Testing Considerations

CI

Compatibility Considerations

no

Upgrade Considerations

changeset defined

[changeset-bot]

🦋 Changeset detected

Latest commit: 6ada52b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 18 packages

Name	Type
@endo/compartment-mapper	Patch
@endo/lp32	Patch
@endo/marshal	Patch
@endo/module-source	Patch
@endo/netstring	Patch
@endo/pass-style	Patch
@endo/patterns	Patch
@endo/stream-node	Patch
@endo/bundle-source	Patch
@endo/check-bundle	Patch
@endo/daemon	Patch
@endo/import-bundle	Patch
@endo/test262-runner	Patch
@endo/captp	Patch
@endo/exo	Patch
@endo/ocapn	Patch
@endo/cli	Patch
@endo/far	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[Copilot]

Pull request overview

This PR removes a set of runtime dependencies that appear to be unused across several @endo/* packages, and adds a maintenance script/config to check for unused runtime dependencies (excluding devDependencies) using Knip.

Changes:

• Removed stale entries from multiple packages/*/package.json dependencies lists (and updated yarn.lock accordingly).
• Added scripts/maintenance/check-unused-deps.sh to run Knip and fail if unused runtime dependencies are detected.
• Added a Knip config (scripts/maintenance/knip.json) and a changeset documenting the dependency hygiene update.

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
yarn.lock	Reflects dependency removals across workspaces.
scripts/maintenance/knip.json	Adds Knip configuration for workspace scanning (but currently contains invalid JSON).
scripts/maintenance/check-unused-deps.sh	Adds a helper script to detect unused runtime dependencies via Knip.
packages/stream-node/package.json	Removes stale runtime deps from dependencies.
packages/patterns/package.json	Removes stale runtime deps from dependencies.
packages/pass-style/package.json	Removes stale runtime deps from dependencies.
packages/ocapn/package.json	Removes stale runtime deps from dependencies.
packages/netstring/package.json	Removes stale runtime deps from dependencies.
packages/module-source/package.json	Removes stale runtime deps from dependencies.
packages/marshal/package.json	Removes stale runtime deps from dependencies.
packages/lp32/package.json	Removes stale runtime deps from dependencies.
packages/daemon/package.json	Removes stale runtime deps from dependencies.
packages/compartment-mapper/package.json	Removes stale runtime deps from dependencies.
packages/cli/package.json	Removes stale runtime deps from dependencies.
.changeset/soft-icons-share.md	Declares patch releases for affected publishable packages.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[kriskowal]

I would favor making #!/bin/bash explicit. The -- in these commands eliminates ambiguity when a filename resembles a flag. It doesn’t come up often but it is on my pile of best practices. If shell check doesn’t complain, though, it’s fine either way.

[kriskowal]

I would favor making #!/bin/bash explicit. The -- in these commands eliminates ambiguity when a filename resembles a flag. It doesn’t come up often but it is on my pile of best practices. If shell check doesn’t complain, though, it’s fine either way.