chore(node): drop 8 unused devDependencies - #2286
Merged
Merged
Conversation
Removes dev tooling that nothing in the repo invokes, cutting 109 packages
(687 -> 578) from yarn.lock.
- ava dead test runner; `scripts.test` is jest. The `ava` config
block and its `@swc-node/register` require went with it.
- benny, chalk only used by `scripts.bench`, which pointed at
- @swc-node/reg. `benchmark/bench.ts` -- a file that does not exist, so the
script was already broken. Dropped the script too.
- @swc/core only a peerDependency of @swc-node/register; jest transforms
via `preset: 'ts-jest'`, not swc.
- husky no `.husky/` directory, no `prepare` script -- the git hook
was never installed.
- lint-staged had an inline config block, but with husky absent nothing
ever ran it.
- npm-run-all only supplied `run-p` for the `format` script, now a plain
`&&` chain. It was the sole source of shell-quote, which
carried a CRITICAL advisory.
Resolves 2 open dependabot alerts (both shell-quote, one critical). The
remaining 31 are not reachable by deletion: tar/cacache/socks/ip-address all
hang off node-gyp <- fsevents <- jest-haste-map, and fsevents is a macOS-only
optional dep of jest, so it never installs on Linux CI at all. Clearing those
needs a jest major bump, not a dependency removal.
None of this ever shipped: `dependencies` is empty and `files` is
["index.d.ts", "index.js"].
Verified: yarn install, yarn lint, jest --listTests (6 suites), and
eslint/prettier/taplo/jest/napi binaries all resolve.
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
This was referenced Aug 5, 2026
ArthurZucker
added a commit
that referenced
this pull request
Aug 5, 2026
Conflict was in bindings/node/yarn.lock only. main's #2286 dropped the same 8 unused devDependencies this branch had already dropped, so the merged package.json is byte-identical to this branch's. Kept this branch's lockfile, which carries the security resolutions on top of that same dependency set. Verified with `yarn install --immutable`.
ArthurZucker
added a commit
that referenced
this pull request
Aug 5, 2026
main's #2286 dropped 8 unused devDependencies; this branch had already dropped those same 8 plus jest/ts-jest/@types/jest (#2288) and added the security resolutions. The branch's package.json is therefore a strict superset of main's changes, so both files resolve to the branch side. Note: git's auto-merge silently re-added "jest": "^29.5.0" to devDependencies, since main still lists it and the surrounding lines moved. That was dropped deliberately in #2288 and is removed here. Verified with `yarn install --immutable`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #2285. That PR removed the wasm example's
package-lock.json(12 alerts). This one goes after the other npm manifest.Context
All 45 open Dependabot alerts on this repo are npm. Zero from cargo, zero from pip. After #2285, all 33 remaining live in
bindings/node/yarn.lock.Worth stating up front: none of it ships.
bindings/node/package.jsonhas an emptydependenciesand"files": ["index.d.ts", "index.js"]. Everything in that lockfile is lint/test/build tooling. Dependabot marks 23 of these "runtime", which is misleading — that's the transitive package's own dependency type, not reachability from the published artifact.What's removed
8 devDependencies that nothing in the repo invokes — 109 packages gone, 687 → 578:
avascripts.testisjest. Its inlineavaconfig block went toobenny,chalk,@swc-node/registerscripts.bench, which pointed atbenchmark/bench.ts— a file that does not exist, so the script was already broken. Dropped the script@swc/core@swc-node/register; jest transforms viapreset: 'ts-jest', not swchusky.husky/dir, nopreparescript — the git hook was never installedlint-stagednpm-run-allrun-pforformat, now a plain&&chainSecurity impact — measured, not assumed
Resolves 2 open alerts, both
shell-quote, one of them CRITICAL.npm-run-allwas its sole source.The other 31 are not reachable by deletion, and I'd rather say so than imply otherwise:
They hang off
jest,eslintand@napi-rs/cli, which are all genuinely needed. Notefseventsis a macOS-only optional dependency — the entiretar/cacache/socks/ip-addresscluster (16 alerts) never installs on Linux CI in the first place. Clearing those needs a jest major bump, which is a separate and riskier change.Verification
yarn install— exit 0, lockfile regenerated with the vendored yarn 3.5.1yarn lint— exit 0, cleanjest --listTests— all 6 suites still discoveredeslint/prettier/taplo/jest/napibinaries all still resolveUnrelated bug spotted
bindings/node/Makefilehascheck-style: npm run lint-check, but there is nolint-checkscript inpackage.json— that target is already broken on main. Left alone here to keep this PR scoped.