chore(deps): audit and clean up dependencies

[waleedlatif1]

Summary

• Removed unused deps: chalk, chart.js, dotenv, encoding, entities, thread-stream, uuid, @opentelemetry/exporter-jaeger, critters, marked, redis, soap
• Replaced `soap` with a hand-rolled Workday SOAP client (XXE-safe XML parser, WS-Security UsernameToken)
• Migrated `marked` to a unified/remark/rehype pipeline for inbox response rendering
• Bumped zustand v5, @react-email/*
• Aligned all @aws-sdk/* packages to 3.1032.0
• Moved type-only deps to devDependencies
• Removed duplicate drizzle-orm/postgres overrides

Type of Change

• Chore / dependency cleanup

Testing

Tested manually — type-check passes.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		May 9, 2026 5:53am

[cursor]

PR Summary

High Risk
High risk because it replaces the Workday SOAP client implementation (request/response parsing, auth headers, error handling) and changes markdown-to-HTML rendering for outbound inbox emails; both are integration-heavy paths that can fail in subtle ways.

Overview
Refactors Workday integrations to drop the soap dependency. createWorkdaySoapClient now sends SOAP-over-HTTP directly with a hand-built WS-Security UsernameToken envelope and a custom, XXE-resistant XML parser, and updates response typing/coercion (parseSoapNumber/parseSoapBoolean) to handle SOAP scalars returned as strings.

Updates Workday API routes to use the new coercion helpers. get-compensation, get-organizations, and list-workers now normalize numeric/boolean fields before computing totals, activity flags, and compensation amounts.

Switches inbox email HTML rendering from marked to a unified/remark/rehype pipeline and makes renderEmailHtml async.

Cleans up and aligns dependencies/config. Removes several unused packages (including soap and marked), bumps/aligns AWS SDK versions, updates @react-email/* and zustand, adjusts Next.js serverExternalPackages, and reclassifies some type packages to devDependencies.

^{Reviewed by Cursor Bugbot for commit 5d8814e. Configure here.}

[greptile-apps]

Greptile Summary

This PR is a large dependency audit and cleanup: it removes unused packages (soap, marked, redis, chalk, uuid, etc.), replaces the soap library with a hand-rolled Workday SOAP client (XXE-safe XML parser + WS-Security UsernameToken), migrates marked to a unified/remark/rehype pipeline for inbox email rendering, aligns all @aws-sdk/* packages to 3.1032.0, and bumps zustand to v5.

• Workday SOAP rewrite (soap.ts): ~430 lines of new code implementing envelope building, a bespoke XML parser, and response mapping; adds parseSoapNumber / parseSoapBoolean helpers and widens interface types to number | string to match the new string-returning parser.
• Markdown pipeline (inbox/response.ts): marked.parse() swapped for unified().use(remarkParse).use(remarkGfm).use(remarkBreaks).use(remarkRehype) + hast-util-to-html; renderEmailHtml is now async.
• Package hygiene: @types/react-window and @types/three correctly moved to devDependencies; duplicate drizzle-orm/postgres overrides removed; all AWS SDK packages pinned to a single version.

Confidence Score: 4/5

The SOAP rewrite and markdown migration are well-implemented; the main outstanding risk is the removal of pino/thread-stream from serverExternalPackages, which was already flagged in a prior review and remains unresolved in this diff.

The hand-rolled XML parser is purpose-built and XXE-safe, and the response-mapping helpers correctly handle string-typed values from the new parser. The remark/rehype migration is equivalent to the old marked pipeline with the same XSS guards intact. The unresolved serverExternalPackages removal for pino and thread-stream is the one item that could cause a silent runtime regression in the standalone/docker build when trigger.dev activity is invoked.

apps/sim/next.config.ts — the removal of pino/pino-pretty/thread-stream from serverExternalPackages warrants verification against the Docker/standalone build with trigger.dev active.

Important Files Changed

Filename	Overview
apps/sim/tools/workday/soap.ts	Core of the PR — replaces the soap npm library with a hand-rolled SOAP-over-HTTP client including XML serializer, bespoke XML parser, fault extractor, and coercion helpers. Well-structured and includes XXE mitigations.
apps/sim/lib/mothership/inbox/response.ts	Swaps marked for a unified/remark/rehype pipeline; renderEmailHtml is now async, correctly awaited at the call site. XSS mitigations preserved.
apps/sim/next.config.ts	Removes pino, pino-pretty, and thread-stream from serverExternalPackages; may cause bundler issues in the standalone Next.js build.
apps/sim/package.json	Removes ~12 unused packages, pins all @aws-sdk/* to 3.1032.0, bumps zustand to v5, moves type-only packages to devDependencies.
apps/sim/app/api/tools/workday/get-organizations/route.ts	Adopts parseSoapBoolean for Inactive and parseSoapNumber for Total_Results; fixes correctness issues from the new string-returning parser.

_{Reviews (3): Last reviewed commit: "fix(workday): coerce compensation amount..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a25b149. Configure here.}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 5d8814e. Configure here.}