fix: Missing dependencies in transpiled browser code

[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.
• Link this pull request to an issue.

Issue

In #2803, two packages were incorrectly identified as unused:

• crypto-js - Was removed from optionalDependencies
• idb-keyval - Was moved from dependencies to devDependencies

However, both packages are still being imported in the transpiled browser code:

• lib/browser/CryptoController.js:12-13 requires crypto-js/aes and crypto-js/enc-utf8
• lib/browser/IndexedDBStorageController.js:9 requires idb-keyval

When Parse Dashboard installs the Parse SDK as a dependency, these packages are missing, causing webpack to fail with "Module not found" errors.

Approach

Add both packages as regular dependencies:

• Added "crypto-js": "4.2.0" to dependencies
• Moved "idb-keyval": "6.2.2" back to dependencies (removed from devDependencies)

For idb-keyval optionalDependencies is not the right solution because:

• Optional dependencies can fail to install - they're meant for truly optional features that the package can work without
• Browser builds DO require crypto-js - it's not optional for them, causing Parse Dashboard to fail

The correct fix is to make crypto-js a regular dependency because:

• Modern build tools (webpack, vite) and bundlers properly tree-shake unused code
• The React Native build specifically imports react-native-crypto-js, not crypto-js
• Browser builds need crypto-js to be available, not optional

This is evidenced by the fact that the build process creates separate bundles for each environment, and each environment only bundles what it actually imports.

[parse-github-assistant]

🚀 Thanks for opening this pull request!

[coderabbitai]

📝 Walkthrough

Walkthrough

The pull request adds a .claude directory to .gitignore under a new "AI agents" section and updates package.json to add crypto-js@4.2.0 as a runtime dependency while moving idb-keyval from devDependencies to dependencies.

Changes

Cohort / File(s)	Change Summary
Gitignore Configuration .gitignore	Adds new "AI agents" section with entry to ignore /.claude directory
Dependency Management package.json	Adds crypto-js@4.2.0 to dependencies; moves idb-keyval@6.2.2 from devDependencies to dependencies

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• refactor: Remove unused dependencies #2803: Modifies the same dependencies (crypto-js and idb-keyval) with opposing dependency-scope changes, indicating potentially related work on dependency management.

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check	✅ Passed	The PR description is comprehensive and well-structured, with detailed context about the issue, the packages involved, and a thorough explanation of the approach taken.
Title check	✅ Passed	The title 'fix: Missing dependencies in transpiled browser code' is clearly related to the main changes in the PR, which involve adding and reorganizing dependencies (crypto-js and idb-keyval) in package.json.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[parseplatformorg]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (1)

package.json (1)

35-36: Recommend: Add brief explanatory comment in PR description.

The PR's "Approach" section is empty, and the rationale for why these dependencies are now required is unclear. This makes it difficult for reviewers to assess the change. Please update the PR description to explain:

• Why crypto-js is needed
• Why idb-keyval moved from dev to runtime dependencies
• Whether this is fixing a missing import or adding new functionality

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between e5bbaa2 and 898eaae.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• .gitignore (1 hunks)
• package.json (1 hunks)

🔇 Additional comments (5)

.gitignore (1)

17-18: Approve .gitignore addition.

Adding the .claude directory to .gitignore is appropriate for isolating AI agent artifacts from version control.

package.json (4)

35-35: Verify crypto-js is actually used in the codebase.

Line 35 adds crypto-js@4.2.0 as a runtime dependency, but there is no evidence in the PR description or approach section explaining where it is imported or used. Adding unused dependencies increases bundle size and maintenance burden.

Search the codebase for imports and usages of crypto-js (e.g., import ... from 'crypto-js', require('crypto-js'), or CryptoJS references). If the dependency is not actually used in production code, remove it from package.json.

---

35-36: Critical: PR issue linkage is missing—clarify which issue this fixes.

The PR description shows "Closes: FILL_THIS_OUT", which means the associated issue is not linked. This makes it impossible to verify whether adding these dependencies is the correct fix. Please fill in the issue number or provide clear context for why crypto-js@4.2.0 and idb-keyval@6.2.2 are required at runtime.

Additionally, clarify why idb-keyval was moved from devDependencies to runtime dependencies and confirm both packages are actually imported in the codebase.

---

36-36: Verify idb-keyval is used in production code to justify moving from devDependencies.

Line 36 adds idb-keyval@6.2.2 as a runtime dependency. While idb-keyval is designed as a runtime library for IndexedDB access in the browser and should be in dependencies when used in production, you need to confirm this package is actually imported and used in production source code (not just in tests or build tooling). If this is a new addition to production code, clarify in the PR description why this IndexedDB integration is necessary.

---

35-36: crypto-js@4.2.0 is the patched version and secure; no vulnerabilities found for idb-keyval@6.2.2.

crypto-js@4.2.0 actually contains the fix for CVE-2023-46233 (PBKDF2 weakness patched October 2023), not a vulnerable version. Both packages are currently free of known security advisories and compatible with Node 18–24. Note: crypto-js has low maintenance activity; consider using Node's native crypto module as an alternative where feasible.

Likely an incorrect or invalid review comment.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.88%. Comparing base (e06b8a7) to head (898eaae).
⚠️ Report is 9 commits behind head on alpha.

Additional details and impacted files

@@           Coverage Diff           @@
##            alpha    #2812   +/-   ##
=======================================
  Coverage   99.88%   99.88%           
=======================================
  Files          64       64           
  Lines        6222     6222           
  Branches     1473     1473           
=======================================
  Hits         6215     6215           
  Misses          7        7           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[parseplatformorg]

🎉 This change has been released in version 7.1.2-alpha.1

[parseplatformorg]

🎉 This change has been released in version 7.1.2