[rush-lib, rig-package, etc.] Dependency cleanup: remove several small third-party packages#5784
Merged
iclanton merged 15 commits intomicrosoft:mainfrom Apr 18, 2026
Merged
Conversation
iclanton
requested review from
apostolisms,
bmiddha,
dmichon-msft,
jxanthony and
octogonz
as code owners
iclanton
force-pushed
the
dependency-cleanup
branch
from
c1811c3 to
ac36e95
Compare
bmiddha
approved these changes
Apr 18, 2026
iclanton
force-pushed
the
dependency-cleanup
branch
from
ac36e95 to
d467f32
Compare
octogonz
approved these changes
Apr 18, 2026
Node 18+ is the minimum supported version, so the native structuredClone is available. The TODO comment tracking this removal is also deleted. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
fast-glob (already a dependency) exposes escapePath, which covers the same characters. Removed the glob-escape package. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
jju is already used by node-core-library for the same purpose (JSONC parsing). Using jju.parse() directly eliminates the strip+parse two-step. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Replaced open() with Executable.spawn() from node-core-library using the platform-native open command (open/xdg-open/cmd start). - Removed the update-notifier block entirely; update notifications are low-value and add a non-trivial dependency chain. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Node 18+ provides module.isBuiltin() natively. The builtin-modules package was a static list that needed to track Node releases. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…p doc Removes builtin-modules, figures, glob-escape, open, strip-json-comments, and update-notifier from nonbrowser-approved-packages.json and @ungap/structured-clone from browser-approved-packages.json. Also expands DEPENDENCY_CLEANUP.md to a full census of all third-party dependencies across apps/, libraries/, heft-plugins/, rigs/, rush-plugins/, vscode-extensions/, webpack/, and repo-scripts/. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaced with a native implementation using the URL class (toHttpsUrl.ts). Added direct unit tests for the new function. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
scheduler@0.27.0 is already installed transitively via react-dom and satisfies the >=0.19.0 peer dependency range of @fluentui/react-context-selector; the explicit pin was redundant. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
iclanton
force-pushed
the
dependency-cleanup
branch
from
31c7151 to
0e3bb9b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Remove several unnecessary third-party dependencies across the monorepo, replacing each with a native Node.js API or a utility already present in the repo.
Details
Each removal is a separate commit:
@ungap/structured-clone(heft-config-file) — replaced with nativestructuredClone(Node 18+)glob-escape(rush-lib) — replaced withfast-glob's built-inescapePath(already a dependency)strip-json-comments(rig-package) — replaced withjju.parse(), whichnode-core-libraryalready uses for the same purposefigures(rush-lib) — the single character used (figures.pointer) replaced with a namedconst POINTER = '\u276F'open(lockfile-explorer) — replaced withExecutable.spawn()fromnode-core-libraryupdate-notifier(lockfile-explorer) — removed entirely; the update notification block was non-essentialbuiltin-modules(rush-lib) — replaced withnode:module.isBuiltin()(Node 18+)giturl(npm-check-fork) — replaced with a newtoHttpsUrl()function using the nativeURLclass; unit-testedscheduler@0.19.0(rush-vscode-command-webview) — explicit pin removed;0.27.0(already installed transitively via react-dom) satisfies the>=0.19.0peer dep range of@fluentui/react-context-selectorAll removed packages are also dropped from
common/config/rush/*-approved-packages.json.How it was tested
toHttpsUrl()innpm-check-fork🤖 Generated with Claude Code