chore(deps): remove dead legacy dependency manifests - #1085
Merged
Conversation
The repository is now a thin launcher around openadapt-flow. The legacy tree is repository-only history: it is excluded from the wheel (packages = ["openadapt"]) and from the sdist (explicit /legacy exclude), and nothing in CI or scripts references these manifests. Dependabot still scans them and reports 260 of the repo's 323 open alerts against them, including all 7 criticals (nltk, deepdiff, torch, h11, transformers in legacy/poetry.lock; shell-quote, next in the legacy dashboard package-lock.json). None of that code ships or runs. Removing the manifests drops the dead dependency graph entries, which auto-dismisses the associated alerts: - legacy/poetry.lock (186 alerts; its pyproject.toml counterpart was already gone) - legacy/openadapt/app/dashboard/package-lock.json (74 alerts) - legacy/openadapt/app/dashboard/package.json (removed alongside the lock so the npm ranges cannot re-materialize as new alerts) The remaining 63 alerts live in uv.lock and are addressed separately by bumping the locked versions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Dependabot reports 323 open alerts on the default branch. 260 of them — including all 7 criticals — are pinned in dependency manifests under
legacy/, the pre-launcher codebase that no longer ships anywhere:legacy/poetry.locklegacy/openadapt/app/dashboard/package-lock.jsonThe legacy tree is repository-only history:
openadapt/([tool.hatch.build.targets.wheel] packages),/legacy,.github/,scripts/, ormkdocs.ymlreferences these manifests,legacy/poetry.lock'spyproject.tomlcounterpart is already gone.This PR deletes the two lockfiles plus the dashboard
package.json(removed with its lock so the npm version ranges cannot re-surface as new range-based alerts). Removing a manifest from the default branch removes its entries from the dependency graph, and GitHub auto-dismisses the associated Dependabot alerts.The remaining 63 alerts are locked versions in
uv.lock(the live launcher lock) and are handled in a separate minimal-bump PR.Test plan
🤖 Generated with Claude Code