Clear npm audit findings and add knip for unused code/deps - #320
Merged
Conversation
Drop the outdated imagemin binary pipeline that accounted for nearly all reported vulnerabilities, and keep Sharp via vite-imagetools plus the existing WebP conversion script for image optimization.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Install knip for dependency hygiene, wire it into npm run qa and CI, drop unused packages (array-shuffle, reset-css, @types/random, semver, @vitest/browser), and declare sharp directly for the WebP script.
Un-export module-local helpers, remove dead components and types, and drop knip's dependency-only include filter so QA enforces the full unused files/exports/deps surface.
nicklemmon
changed the title
Satisfy Vite's upcoming native config loader, which requires explicit extensions on relative config imports.
Drop blank progress lines when nothing is converted, and print a single compact summary instead of a padded multi-line report.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
vite-plugin-imagemin, whose outdated imagemin binary-download stack accounted for nearly allnpm auditfindings (including critical Zip Slip issues at install time).vite-imagetools, plus the WebP conversion Vite plugin/script.npm run qaand CI with a clean full baseline.array-shuffle,reset-css,@types/random,semver,@vitest/browser.sharpas a direct dependency (used byscripts/convert-to-webp.ts).npm auditgoes from 42 vulnerabilities → 0.Test plan
npm auditreports 0 vulnerabilitiesnpm run knippasses with full (default) rulesnpm run buildsucceedsnpm run qapasses (format, typecheck, lint, knip, 138 tests)