Skip to content

Conversation

@dakshydv
Copy link
Contributor

This PR removes unused and vulnerable dependencies from package.json. These libraries are not referenced anywhere in the codebase and introduce unnecessary security risks.

Fixes: #4768

Changes Made

  • Removed lodash.template: ^4.5.0 from package.json dependencies
  • Removed node-static: ^0.7.11 from package.json dependencies
  • Updated package-lock.json to reflect dependency removal

@github-actions
Copy link
Contributor

✅ All Jest tests passed! This PR is ready to merge.

@omsuneri
Copy link
Member

omsuneri commented Oct 26, 2025

@walterbender i m not sure what to do with this can you please review it !!

@omsuneri omsuneri requested a review from walterbender October 26, 2025 20:25
@walterbender walterbender merged commit 1d0c018 into sugarlabs:master Nov 8, 2025
5 checks passed
@walterbender
Copy link
Member

Aargh. This broke npm run serve.

@dakshydv
Copy link
Contributor Author

dakshydv commented Nov 8, 2025

Hi! I tested with a clean installation but wasn't able to reproduce this issue - the server starts successfully for me at http://127.0.0.1:3000/ . Could you please share the specific error or log?
image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Remove unused and vulnerable dependencies

3 participants