Skip to content

chore(deps): audit deps, move several to devDependencies#524

Draft
cwillisf wants to merge 1 commit intodevelopfrom
dependency-audit
Draft

chore(deps): audit deps, move several to devDependencies#524
cwillisf wants to merge 1 commit intodevelopfrom
dependency-audit

Conversation

@cwillisf
Copy link
Copy Markdown
Contributor

Proposed Changes

Three categories of changes:

  • A few deps were unused and have been removed
  • Some webpack loaders are used only during build and have moved to devDependencies
  • scratch-render exposes two loaders to library consumers when those consumers use the webpack export specifically. Those loaders were listed as dependencies, but it's more correct to list them as devDependencies (for scratch-render build) as well as optional peerDependencies (for webpack consumers)

Test Coverage

Covered by the existing build & test steps

Three categories of changes:
- A few deps were unused and have been removed
- Some webpack loaders are used only during build and have moved to
  `devDependencies`
- `scratch-render` exposes two loaders to library consumers when those
  consumers use the `webpack` export specifically. Those loaders were
  listed as `dependencies`, but it's more correct to list them as
  `devDependencies` (for `scratch-render` build) as well as optional
  `peerDependencies` (for webpack consumers)
@cwillisf cwillisf requested a review from Copilot April 14, 2026 13:27
@cwillisf cwillisf requested a review from a team as a code owner April 14, 2026 13:27
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR audits dependency declarations across the monorepo packages, removing unused packages and reclassifying build-time webpack loaders so that runtime consumers aren’t forced to install them.

Changes:

  • Remove unused loader deps from scratch-vm and scratch-svg-renderer.
  • Move build-only webpack loaders (and related tooling deps) in scratch-gui/scratch-render into devDependencies.
  • For scratch-render, re-declare ify-loader/raw-loader as optional peer dependencies for consumers using the webpack export condition, and update package-lock.json accordingly.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
packages/scratch-vm/package.json Drops arraybuffer-loader from runtime dependencies.
packages/scratch-svg-renderer/package.json Drops base64-loader from runtime dependencies.
packages/scratch-render/package.json Moves ify-loader/raw-loader to devDeps and adds them as optional peer deps for webpack consumers.
packages/scratch-gui/package.json Moves various build/test tooling and webpack loaders to devDependencies; removes react-redux from dependencies.
package-lock.json Re-locks dependency graph to reflect dependency/devDependency/peerDependency changes.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

"react-ga": "3.3.1",
"react-intl": "6.8.9",
"react-modal": "3.16.3",
"react-popover": "0.5.10",
Copy link

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

react-redux is still imported throughout scratch-gui (e.g. many connect/Provider usages), but it has been removed from dependencies and is now only declared as a peerDependency. This is a behavioral change for consumers whose package manager does not auto-install peer deps (or has peer auto-install disabled): they will now get runtime/build failures unless they add react-redux explicitly. If this change is intentional, it should be called out as a breaking change in release notes; otherwise consider keeping react-redux as a direct dependency (while also keeping it as a peer to avoid duplicate React trees).

Suggested change
"react-popover": "0.5.10",
"react-popover": "0.5.10",
"react-redux": "9.1.2",

Copilot uses AI. Check for mistakes.
Comment on lines +95 to +102
},
"peerDependenciesMeta": {
"ify-loader": {
"optional": true
},
"raw-loader": {
"optional": true
}
Copy link

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ify-loader and raw-loader are required by the webpack export path (inline !ify-loader! / raw-loader! usage in src/), but they are declared as optional peerDependencies. With this setup, webpack consumers who rely on the webpack condition can hit a build-time "module not found" without any peer-dep warning during install. Consider making these peer deps non-optional (and instead document that they’re only needed when using the webpack export), or add a clearer install-time signal via documentation/tooling so webpack consumers discover the requirement earlier.

Suggested change
},
"peerDependenciesMeta": {
"ify-loader": {
"optional": true
},
"raw-loader": {
"optional": true
}

Copilot uses AI. Check for mistakes.
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 14, 2026

Test Results

    8 files  1 078 suites   12m 42s ⏱️
2 705 tests 2 697 ✅  8 💤 0 ❌
6 251 runs  6 212 ✅ 39 💤 0 ❌

Results for commit f51568c.

♻️ This comment has been updated with latest results.

@cwillisf cwillisf marked this pull request as draft April 14, 2026 13:47
@cwillisf
Copy link
Copy Markdown
Contributor Author

I want to think more carefully about the peerDependencies situation before merging this. Also, this should probably be marked as a breaking change due to the scratch-render loaders at least, and maybe the react-redux change (depending on how I/we decide to handle the peerDependencies question).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants