chore(repo): Consolidate overlapping dev dependencies by dominic-clerk · Pull Request #10485 · clerk/javascript

dominic-clerk · 2026-10-28T09:07:43Z

Description

Stacked on #10484. Drops dev dependencies that overlap with something the repo already requires. Lockfile drops 15 resolved packages (npm-run-all's tree, incl. string.prototype.padend, cross-spawn@6, read-pkg@3); nothing added or upgraded.

@clerk/backend: npm-run-all → pnpm a && pnpm b (same pattern as ui's build). A failing test:node still stops before test:edge-runtime.
root: uuid → randomUUID from node:crypto in integration/testUtils/handshake.ts
root: cross-spawn / @types/cross-spawn had no importers; execa and zx cover process spawning

Kept on purpose: execa (integration harness relies on its reject/cleanup semantics), chalk/fs-extra (already pulled transitively or vendored by zx, no savings), expo's base-64 (replaces Hermes' broken atob/btoa, which shared's helpers call), tsup/tsdown and jsdom/happy-dom (would change build output or test behavior).

Part of SEC-493

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

🤖 Generated with Claude Code

changeset-bot · 2026-10-28T09:07:48Z

🦋 Changeset detected

Latest commit: 90a9b2b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel · 2026-10-28T09:07:49Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 29, 2026 5:54am UTC
swingset	Ready	Preview	Oct 29, 2026 5:54am UTC

coderabbitai · 2026-10-28T09:07:53Z

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Files ignored due to path filters: 1

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Run configuration

Source mode: Auto
Repository: clerk/javascript
Branch: dominic/sec-493-consolidate-overlapping-deps
File: .coderabbit.yaml
Commit: 90a9b2b
Layers: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Team
Run ID: 6f40a682-f06d-4f60-bc06-387e09a2ac36

Commits

Reviewing files that changed from the base of the PR and between b49f022 and 90a9b2b.

Files ignored due to path filters: 1

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: clerk/javascript
Branch: dominic/sec-493-consolidate-overlapping-deps
File: .coderabbit.yaml
Commit: b49f022
Layers: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Team
Run ID: b8f5535f-095a-4ec9-971f-fbf48b40d9be

Commits

Reviewing files that changed from the base of the PR and between f46f7ec and b49f022.

Files ignored due to path filters: 1

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 4

.changeset/consolidate-overlapping-dev-dependencies.md
integration/testUtils/handshake.ts
package.json
packages/backend/package.json

Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

clerk/clerk_go (manual)
clerk/dashboard (manual)
clerk/accounts (manual)
clerk/backoffice (manual)
clerk/clerk (manual)
clerk/clerk-docs (manual)
clerk/cloudflare-workers (manual)
clerk/clerk-android (auto-detected)
clerk/clerk-ios (auto-detected)
clerk/cli (auto-detected)

Files with no reviewable changes: 1

package.json

Included review availability: This review used your included allowance. 6 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 8 reviews per hour.

Walkthrough

Integration test configuration now uses randomUUID() from node:crypto to generate identifiers. Root development dependencies remove uuid, cross-spawn, and @types/cross-spawn. Backend test scripts use && to run Node and edge-runtime commands in sequence, and backend development dependencies remove npm-run-all. The changeset file contains empty frontmatter delimiters.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: wobsoriano

Merge Risk: Minimal · previous review b49f0

The dependency cleanup is mergeable with no identified compatibility, runtime, or data risk.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely summarizes the main change: consolidating overlapping development dependencies.
Description check		The description directly explains the dependency removals, replacement of uuid and npm-run-all, retained dependencies, and validation results.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 1 files. (2 skipped: 2 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Linked repositories: Some configured repositories could not be included in this review. Cross-repository analysis may be incomplete. Please check linked-repository access and settings.

_{Comment @coderabbitai help to get the list of available commands.}

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

pkg-pr-new · 2026-10-29T05:54:34Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10485

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10485

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10485

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10485

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10485

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10485

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10485

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10485

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10485

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10485

@clerk/expo-native-components

npm i https://pkg.pr.new/@clerk/expo-native-components@10485

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10485

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10485

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10485

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10485

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10485

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10485

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10485

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10485

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10485

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10485

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10485

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10485

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10485

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10485

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10485

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10485

commit: 90a9b2b

github-actions · 2026-10-29T05:57:16Z

API Changes Report

Generated by Break Check on 2026-10-29T05:57:13.241Z

Summary

Metric	Count
Packages analyzed	20
Packages with changes	0
🔴 Breaking changes	0
🟡 Non-breaking changes	0
🟢 Additions	0

No API Changes Detected

All packages have stable APIs with no detected changes.

Report generated by Break Check

_{Last ran on 90a9b2b.}

github-actions Bot added backend integration labels Oct 28, 2026

dominic-clerk added this pull request to stack #10486 October 28, 2026 09:08

vercel Bot deployed to Preview – clerk-js-sandbox October 28, 2026 09:08

View deployment

vercel Bot deployed to Preview – swingset October 28, 2026 09:10

View deployment

Base automatically changed from dominic/sec-493-trim-dependencies-with-trim-reaper to main October 29, 2026 05:51

chore(repo): Consolidate overlapping dev dependencies

90a9b2b

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

dominic-clerk force-pushed the dominic/sec-493-consolidate-overlapping-deps branch from b49f022 to 90a9b2b Compare October 29, 2026 05:51

vercel Bot deployed to Preview – clerk-js-sandbox October 29, 2026 05:51

View deployment

vercel Bot deployed to Preview – swingset October 29, 2026 05:54

View deployment

dominic-clerk mentioned this pull request Oct 29, 2026

chore(repo): Move tslib to devDependencies #10521

Merged

3 of 9 tasks

wobsoriano approved these changes Oct 29, 2026

View reviewed changes

dominic-clerk merged commit 8098bb9 into main Oct 29, 2026
58 checks passed

dominic-clerk deleted the dominic/sec-493-consolidate-overlapping-deps branch October 29, 2026 12:29

Navigation Menu

Repository navigation

chore(repo): Consolidate overlapping dev dependencies - #10485

chore(repo): Consolidate overlapping dev dependencies#10485
dominic-clerk merged 1 commit into
mainfrom
dominic/sec-493-consolidate-overlapping-deps

dominic-clerk commented Oct 28, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 28, 2026 •

edited

Loading

Review skipped

Uh oh!

pkg-pr-new Bot commented Oct 29, 2026

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dominic-clerk commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Type of change

Uh oh!

changeset-bot Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

vercel Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

pkg-pr-new Bot commented Oct 29, 2026

Uh oh!

github-actions Bot commented Oct 29, 2026

API Changes Report

Summary

No API Changes Detected

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dominic-clerk commented Oct 28, 2026 •

edited

Loading

changeset-bot Bot commented Oct 28, 2026 •

edited

Loading

vercel Bot commented Oct 28, 2026 •

edited

Loading

coderabbitai Bot commented Oct 28, 2026 •

edited

Loading