build: add knip for dead code detection#4190
Merged
MarshallOfSound merged 4 commits intonextfrom Mar 24, 2026
Merged
Conversation
- Add knip as a dev dependency with per-workspace configuration - Add knip to CI lint step - Remove unused files: deprecate.ts, linux-installer.ts - Remove unused dependencies from workspace packages - Remove 37 redundant dependencies from root package.json (duplicated in workspaces) - Remove dead type exports (DMG config types, StandaloneWebpackPreloadEntryPoint) - Add missing test-utils devDeps to create-electron-app and core-utils - Inline unused builtins export into external in vite.base.config.ts
Removed @electron/fuses, electron-installer-common, lodash-es, and msw from root devDependencies as they are already declared in the workspace packages that use them. Simplified knip ignoreDependencies accordingly.
Mark src/**/*.ts project globs with ! suffix so knip --production can follow imports through source files. This enables detection of dependencies that are only used in spec files but incorrectly listed as runtime dependencies. Also move root tools/ dependencies to devDependencies since the root package is private and tools/ scripts are dev-only.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
erickzhao
approved these changes
Mar 24, 2026
| "postinstall": "husky install && node -e \"try { fs.rmSync('node_modules/.bin/*.ps1', { recursive: true, force: true }) } catch (e) {}\" && tsx ./tools/gen-tsconfigs.ts && tsx ./tools/gen-ts-glue.ts", | ||
| "spawn-verdaccio": "tsx tools/verdaccio/spawn-verdaccio.ts" | ||
| }, | ||
| "dependencies": { |
Member
There was a problem hiding this comment.
LGTM! I think we talked about this before in some meeting, but I'm all for moving away from hoisting all deps into the workspace root.
Makes it slightly harder to track deps over time but having knip as a lint step helps keep us tapped in.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds knip to detect unused files, dependencies, and exports across the monorepo. Configured per-workspace with entry points auto-detected from each
package.json'sexports/binfields.The
yarn knipscript runs both default and--productionmodes:dependenciesthat are only imported in spec files (should bedevDependencies)Added to the CI lint step so dead code can't sneak back in.
Dead code removed
Files
packages/api/core/src/util/deprecate.ts— never importedpackages/api/core/src/util/linux-installer.ts— never importedExports
info()frommessages.ts— onlywarn()was usedbuiltinsfromvite.base.config.ts— inlined intoexternalDMGContents,AdditionalDMGOptions,CodeSignOptions,WindowPositionOptions,WindowSizeOptions,WindowOptions) — superseded byElectronInstallerDMGOptionsStandaloneWebpackPreloadEntryPointfrom webpackConfig.ts— never referencedDependencies
package.jsonthat were duplicated in workspace packages (legacy hoisting pattern)devDependenciessince the root package is private andtools/scripts are dev-only@electron/rebuild,@vscode/sudo-prompt,parse-author,cross-spawn,@types/interpret,@types/progress,yaml-hook, and unused@electron-forge/test-utilsfrom 8 maker packages that don't import itMissing deps added
@electron-forge/test-utilstocreate-electron-appandcore-utilsdevDeps — used in spec files but not declaredConfiguration notes
The
knip.jsonhandles a few project-specific patterns:subprocess-worker.ts(vite plugin) andremote-rebuild.ts(core-utils) are spawned via string paths, so they're explicit entry pointscreate-electron-appresolves templates viaimport.meta.resolve()string interpolation, so@electron-forge/template-*are ignoredsrc/**/*.ts!(with!suffix) marks source as production scope so--productionmode can follow importsTesting