Skip to content

build: remove unused Python, client, and documentation dependencies - #15725

Merged
frankie567 merged 2 commits into
mainfrom
codex/python-dependency-audit
Oct 21, 2026
Merged

frankie567 merged 2 commits into
mainfrom
codex/python-dependency-audit

Conversation

@frankie567

@frankie567 frankie567 commented Oct 21, 2026 •

Copy link
Copy Markdown
Member

Summary

Remove unused Python and JavaScript dependencies after auditing imports, scripts, configuration, framework plugins, peer dependencies, and deployment packaging across the server, image resizer, SDK generator, clients, docs, and handbook. Refresh the corresponding lockfiles without upgrading retained package versions.

The client/docs/handbook audit removes 38 direct dependency declarations (including one duplicate), plus one unused catalog entry. All server runtime packages remain required. Intentionally retained implicit dependencies include SQLAlchemy's greenlet support, FastAPI form parsing, certificate trust bundles, Expo native integrations, framework peers, and the separate TypeScript compiler executable/API packages.

Server — server/

Removed dependency or declaration Rationale
debugpy No imports or debugger CLI invocations; VS Code supplies its debugger through the extension.
pytest-recording No VCR fixtures, marks, cassettes, recording configuration, or CI arguments.
pytest-subtests No subtests fixture or unittest subtest usage.
types-python-slugify The library ships its own annotations; raise its minimum to 8.0.2, where those annotations became available.
types-requests No server code imports Requests or uses its types.
boto3-stubs[lambda] extra No Lambda client or stub consumer; keep S3, SQS, and Scheduler extras.
Development typer declaration Identical runtime requirement already provides it.
Development sqlalchemy-utils declaration Runtime requirement already provides it; preserve the effective >=0.41.2 minimum there.

Retain types-redis: current aliases still depend on its generic Redis/Pipeline types. The lockfile also drops orphaned vcrpy.

Image resizer — lambda/image-resizer/

Removed dependency or declaration Rationale
types-Pillow Pillow ships its own annotations; the stubs target an older API. Add an Image.Image variable annotation to accommodate Pillow's native types.
Runtime taskipy declaration Used only by development/CI tasks; move it to the development group.

Keep certifi for botocore's trust bundle and preserve the deployment packaging configuration.

SDK generator — sdk/generator/

Removed dependency Rationale
Development adaptix No generator source, tests, configuration, or release-tool consumer. Generated SDKs declare their own dependencies separately.
Development httpx No generator consumer; generated SDK dependencies remain unchanged.

Web app — clients/apps/web/

Removed dependency Rationale
@polar-sh/sdk References are displayed examples or prose, not executable imports.
@radix-ui/react-dropdown-menu No direct import or configuration consumer. Shared components declare their own dependencies.
geist No font import or configuration consumer.
react-focus-lock No direct consumer; Orbit owns its own FocusLock dependency.
react-timeago No direct consumer; the shared UI package owns its TimeAgo dependency.
rehype-mdx-import-media Not configured in the MDX pipeline; only mentioned in a stale comment.
@types/web No explicit type consumer; TypeScript already provides the standard DOM library.
@vitest/ui No test UI command or configuration.
autoprefixer Not configured; the app uses Tailwind 4's PostCSS integration.
remark No direct import or configured pipeline use.
remark-mdx No direct import or configured pipeline use.

Mobile app — clients/apps/app/

Removed dependency Rationale
@dev-plugins/react-navigation Never initialized; remove its obsolete Expo doctor exclusion.
@react-navigation/bottom-tabs No app consumer or dependency/peer requirement from retained packages.
expo-blur No import, plugin, or retained-package requirement.
expo-status-bar No import, plugin, or retained-package requirement.
nativewind No CSS, class names, Metro/Babel integration, or environment declaration; remove the stale tsconfig include.
tailwindcss No mobile styles or build configuration using it.
patch-package No patch files; remove the inert postinstall invocation.
@types/react-test-renderer No source/test consumer of its types; retain the renderer used by Jest.

Shared UI — clients/packages/ui/

Removed dependency Rationale
@radix-ui/react-checkbox No direct import; compatibility export forwards to Orbit.
@radix-ui/react-select No direct import or configuration consumer.
@radix-ui/react-switch No direct import or configuration consumer.
@radix-ui/react-tabs No direct import or configuration consumer.
@radix-ui/react-toast No direct import or configuration consumer.
@radix-ui/react-tooltip No direct import; compatibility export forwards to Orbit.

Orbit continues to declare the Radix dependencies its implementations need.

Checkout — clients/packages/checkout/

Removed declaration Rationale
Development date-fns Duplicate of the identical runtime declaration, which remains.

Orbit package — clients/packages/orbit/

Removed dependency Rationale
@vitest/coverage-v8 Tests run without coverage; no configured coverage command or CI consumer.

Better Auth example — clients/adapters/better-auth/example/

Removed dependency Rationale
@typescript/native Standalone example runs Next commands without invoking tsc; Next uses the retained typescript compiler API.

Client workspace configuration — clients/

Removed catalog entry Rationale
@vitest/ui No manifest references remain after removing the unused web declaration.

Root tooling remains: esbuild is used by the bundle-measurement script, and @manypkg/cli has an explicit workspace policy.

Documentation — docs/

Removed dependency Rationale
@scalar/openapi-parser No remaining script, source, or CI consumer.
@types/node No local TypeScript project or tooling requires a direct declaration.
js-yaml No local YAML-processing script; keep security overrides for transitive copies.
openapi-sampler No remaining sample-generation script or CI consumer.
tsx No TypeScript scripts to execute.

Keep Mintlify, React, and React DOM for documentation rendering. OpenAPI generation is handled by the Python SDK generator.

Handbook — handbook/

Removed dependency Rationale
@scalar/openapi-parser No source, script, or CI consumer.
@types/node No local TypeScript project or tooling requires a direct declaration.
js-yaml No local YAML-processing script; keep security overrides for transitive copies.
openapi-sampler No sample-generation consumer.
tsx No TypeScript scripts to execute; the tech-notes utility is a shell script.

Keep Mintlify, React, and React DOM for handbook rendering.

Validation

  • Python generator: 153 tests passed; lint and type checks passed.
  • Image resizer: 35 tests passed; lint and type checks passed.
  • Server: lint passed, mypy passed across 1,783 files, and 9,083 selected tests collected successfully with removed dependencies uninstalled.
  • Clients: 1,557 tests passed across checkout, Orbit, web, mobile, MCP, and adapters; adapter builds and typechecks passed. Mobile, Orbit app, demo app, MCP, web, and checkout typechecks passed; web/checkout were checked again after rebasing onto current main.
  • Full clients oxlint and changed-manifest formatting checks passed. Mobile lint-rule self-checks and offline Expo configuration resolution passed.
  • Frozen pnpm installs and Python lockfile checks passed. Retained package versions were not upgraded.
  • Docs and handbook source validation passed with package-manager files excluded in temporary source copies. Running Mintlify validation directly in either project encounters its existing YAML-parser incompatibility with the multi-document pnpm lockfile.
  • Polar review: conventions, Accepted ADRs, reuse, slop, and API surface.

Not run: full server test execution, production Next builds, native/device builds, standalone Better Auth example build, or hosted CI. No API contract or application behavior changes are intended.

View guided diff Turn on auto-fix

@mintlify

mintlify Bot commented Oct 21, 2026 •

Copy link
Copy Markdown

Preview deployment for your docs. Learn more about Mintlify Previews.

Project Status Preview Updated
Polar 🟢 Ready View Preview Oct 21, 2026, 8:30 AM

💡 Tip: Enable Automations to automatically generate PRs for you.

@vercel

vercel Bot commented Oct 21, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
orbit Ready Ready Preview Oct 21, 2026 8:31am UTC
polar-test Ready Ready Preview Oct 21, 2026 8:31am UTC

Request Review

@mintlify

mintlify Bot commented Oct 21, 2026 •

Copy link
Copy Markdown

Preview deployment for your docs. Learn more about Mintlify Previews.

Project Status Preview Updated
Handbook 🟢 Ready View Preview Oct 21, 2026, 8:29 AM

💡 Tip: Enable Automations to automatically generate PRs for you.

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 20 files

Confidence score: 5/5

  • Automated review surfaced no issues in the provided summaries.
  • No files require special attention.

Auto-approved: Bounded dependency and configuration cleanup: removes unused Python/JS dependencies, refreshes lockfiles, and makes one type-annotation adjustment; no runtime behavior change, so remaining risk is ordinary implementation correctness already reviewed.

View guided diff | Turn on auto-fix | Re-trigger cubic

@frankie567
frankie567 marked this pull request as ready for review October 21, 2026 08:32
@github-actions

Copy link
Copy Markdown
Contributor

🚀 Expo preview is ready!

  • Project → Polar
  • Platforms → android, ios
  • Scheme → polar
  • Runtime Version → 1.8.0
  • More info

Learn more about 𝝠 Expo Github Action

@frankie567
frankie567 enabled auto-merge October 21, 2026 08:53

@sebastianekstrom sebastianekstrom left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice 🙌

@frankie567
frankie567 added this pull request to the merge queue Oct 21, 2026
Merged via the queue into main with commit 043e0b7 Oct 21, 2026
40 of 55 checks passed
@frankie567
frankie567 deleted the codex/python-dependency-audit branch October 21, 2026 12:40

This branch was successfully deployed

4 active deployments
Preview – polar-test — a3a550a0 Deployed Oct 21, 2026 by vercel[bot]
Preview – orbit — a3a550a0 Deployed Oct 21, 2026 by vercel[bot]
staging - docs — a3a550a0 Deployed Oct 21, 2026 by mintlify[bot]
staging - handbook — a3a550a0 Deployed Oct 21, 2026 by mintlify[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants