/audit-and-reduce-dependencies

name: audit-and-reduce-dependencies
license: Apache-2.0
description: >-
  Reduces JavaScript dependency footprint with pnpm while preserving lockfile,
  workspace layout, and dependency range style. Runs /check-npm first, then
  removes unused deps, dedupes versions, ranks transitive closure, and reports
  Keep/Replace/Remove triage. Use when cleaning up pnpm dependencies, reducing
  lockfile size, or shrinking node_modules in Grafana plugins; not for Go
  modules or full GitHub Actions workflow audits.

Audit and reduce dependencies

Reduce JavaScript dependency footprint. Use **pnpm only**. Preserve the lockfile, workspace layout, and dependency range style unless there is a concrete reason to change them.

For GitHub Actions workflow triage (action choice, permissions, pinning), use a dedicated workflow audit — not the reporting format below (workflow file + step only when the finding is **pnpm install policy**).

Workflow

0. Hardening gate: run `/check-npm` (read-only). See [check-npm](../check-npm/SKILL.md). 1. Establish the baseline. 2. Remove unused direct dependencies. 3. Deduplicate direct dependency versions in monorepos. 4. Rank direct dependencies by transitive lockfile closure. 5. Use closure data to find low-risk minor/patch upgrades. 6. Use closure data to find trivial dependencies worth inlining. 7. Check e18e recommendations for replacements/removals. 8. Reinstall, verify, and report measured impact.

Step 0: Hardening gate (`/check-npm`)

Run **`/check-npm`** before mutating manifests or lockfiles.

• If any check **FAIL**s: report the table and fix snippets; **do not weaken** `pnpm-workspace.yaml`, `.npmrc`, CI install flags, or Renovate age gates during cleanup.
• Do not paste full hardening config into this workflow — `/check-npm` owns version thresholds, script policy, git-dep protocols, and min release age.
• If the user only asked for hardening (not reduction), stop after `/check-npm` unless they also want cleanup.

**pnpm 11+:** script and release-age policy live in `pnpm-workspace.yaml`, not `.npmrc` or `package.json#pnpm` (pnpm 11 no longer reads the `package.json#pnpm` field). Verify each key against the installed pnpm major before suggesting config. Never add unsupported keys. Do not lower an existing `minimumReleaseAge` (or org equivalent) during cleanup.

Dependency triage

For each non-trivial direct dependency (especially after Steps 4–7), assign one label:

| Label | Meaning | |-------|---------| | **Keep** | Required; worthwhile transitive cost; well maintained. | | **Replace-with-Better** | Required; better-maintained or safer alternative exists. | | **Replace-with-Internal** | Required; external risk warrants internal implementation. | | **Remove** | Can drop or inline (Step 6). | | **Needs-user-review** | Ambiguous usage, policy tradeoff, or change needing human verification. |

**Replacements and new direct deps**

• **No new direct dependencies** (including swaps) without explicit user approval.
• Prefer **Remove** (inline/native APIs) over **Replace-with-Better** when equivalent.
• For **Replace-with-Better**: state why (maintenance, security, smaller tree); prefer actively maintained, widely adopted packages from trusted maintainers.
• Respect repo `minimumReleaseAge` / Renovate gates; command-level 72h freshness is a floor, not permission to bypass stricter config.

pnpm & supply-chain

Confirm the repo uses pnpm: `pnpm-lock.yaml`, `pnpm-workspace.yaml`, and/or `packageManager` / `devEngines.packageManager.name` set to `pnpm` in root `package.json`. If not on pnpm, stop — do not migrate package managers as part of cleanup.

Respect repo install policy when present (e.g. `pnpm install --frozen-lockfile --ignore-scripts`).

| Action | Command | |--------|---------| | Install/update lockfile | `pnpm install --ignore-scripts` (+ repo flags, e.g. `--frozen-lockfile`) | | Remove direct dependency | `pnpm remove <pkg> --ignore-scripts` | | Add/update direct dependency | `pnpm add <pkg>@<version> --ignore-scripts` | | Explain dependency | `pnpm why <pkg>` | | Dedupe lockfile | `pnpm dedupe` (then `pnpm install --ignore-scripts` if lockfile changed) | | Outdated / version info | `pnpm outdated <pkg>` | | One-off tools | `pnpm --config.ignore-scripts=true dlx <pkg>@<version> <args...>` (pin version; prefer `pnpm exec` when in lockfile) |

**Lifecycle scripts:** Always `--ignore-scripts` on `pnpm install`, `pnpm add`, and `pnpm remove` unless the user explicitly writes **allow scripts** in the same message (state which scripts would run and the risk). For `pnpm dlx`, `dlx` does not accept `--ignore-scripts` directly — use `pnpm --config.ignore-scripts=true dlx` (flags after `dlx` are forwarded to the executed binary). If a dependency legitimately needs a build script (native modules, etc.), finish without scripts, then ask whether to run a **specific** manual rebuild (e.g. `pnpm rebuild <pkg>`).

**Freshness check (≥ 72 hours)** — required before any command that adds or upgrades a **named package version** (`pnpm add`, `pnpm dlx` with new/upgraded direct version). **Not required** for plain `pnpm install` / `pnpm remove` with no new package argument.

For each directly named package:

1. `curl -s https://registry.npmjs.org/<package-name>` 2. Resolve version: pinned `pkg@1.2.3` → that version; range/`latest`/unspecified → `dist-tags.latest` 3. Read `time["<version>"]` 4. If published **less than 72 hours ago** → **stop**. Tell the user package, version, and exact age. Suggest an older known-good pin unless they write **override freshness check**. 5. **`@grafana/*`** scoped packages are **exempt** from the freshness check; `--ignore-scripts` still applies.

After a failed freshness check, do not substitute a different version without user approval.

Safety rules

• Work in small batches so lockfile diffs remain reviewable.
• Never trust unused-dependency tools blindly; verify imports, config files, scripts, generated code hooks, fr