Skip to content

chore(deps): drop the unused gulp dependency + ignore migration-gated majors - #133

Merged
ribato22 merged 1 commit into
mainfrom
chore/deps-hygiene
Jul 27, 2026
Merged

chore(deps): drop the unused gulp dependency + ignore migration-gated majors#133
ribato22 merged 1 commit into
mainfrom
chore/deps-hygiene

Conversation

@ribato22

Copy link
Copy Markdown
Owner

Closes out the Dependabot triage.

1. Remove the dead gulp dependency

gulp sat in packages/n8n-nodes-multiwa devDependencies — a leftover from the n8n community-node scaffold (whose template runs gulp build:icons). This package instead builds with tsc && cp -f …svg, has no gulpfile, and never imports it.

Dependabot kept proposing gulp 4→5 (#129) for a dependency nothing uses. Removing it instead:

  • −2,097 lines of transitive tree from pnpm-lock.yaml (gulp 4 drags a large, aging sub-dependency graph)
  • Verified surgical: the only specifier/version pair removed is gulp's own ^4.0.2; the rest of the diff is packages flipping to optional: true.

2. Two more ignore rules for majors that can't be drop-in bumped

Verification

  • n8n-nodes-multiwa build ✓ · api / worker tsc --noEmit
  • Lockfile still air-gap safe (0 ssh:// refs — the pnpm.overrides HTTPS pins hold)
  • dependabot.yml parses as valid YAML

Triage summary (this pass)

Merged (10): #114 setup-python · #116 production-group (19 deps) · #117 framer-motion 12 · #120 bcrypt 6 · #121 nodemailer 9 · #122 pino 10 · #126 lucide 0.577 · #127 dev-group (9) · #128 globals 17 · #130 @eslint/js
Closed with reasons (8): #115 dev-group (majors) · #118/#119 React 19 (needs Next 15) · #123 tailwind-merge 3 · #124 lucide 1.x · #129 gulp (dead) · #131 coverage-v8 (vitest mismatch) · #132 tailwind v4
Config (#125 + this): dev group restricted to minor/patch; migration-gated majors ignored.

Post-merge main verified: all workspace packages build, api/worker/admin typecheck, api 324/324 + worker 34/34 tests green.

… majors

gulp was declared in packages/n8n-nodes-multiwa devDependencies — a leftover
from the n8n community-node scaffold (which uses `gulp build:icons`) — but this
package builds with `tsc && cp -f …svg`, has no gulpfile, and never imports it.
Removing the dead dep drops 2,097 lines of transitive tree from the lockfile
(and with it gulp 4's aging sub-dependencies). Verified: only gulp's own
specifier disappears; the remaining diff is packages flipping to `optional`.

Also ignore two more majors that can't be drop-in bumped, so Dependabot stops
re-opening PRs that can never merge:
- tailwindcss — v4 is a full migration (new engine, CSS-first config, changed
  class semantics); pairs with the tailwind-merge v3 hold.
- @vitest/coverage-v8 — must match the vitest major (pinned ^2), so it can only
  move as part of a deliberate vitest upgrade.

n8n-nodes build + api/worker typecheck green; lockfile still air-gap safe (0 ssh refs).
@ribato22
ribato22 merged commit 448d46c into main Jul 27, 2026
8 checks passed
@ribato22
ribato22 deleted the chore/deps-hygiene branch July 27, 2026 08:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant