build: runtime renderer dependencies sit in devDependencies in package.json
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- typescript, vite
- Domain
- build-system
Research direction
Start in package.json around lines 150-197 and move the renderer packages (dompurify, marked, marked-highlight, highlight.js, diff2html, @xterm/xterm, @xterm/addon-fit) from devDependencies to dependencies. Then open electron.vite.config.ts lines 19-22 and pass the exclude option to externalizeDepsPlugin for the MCP and Claude Agent SDKs. Done when npm run build succeeds and npm audit --omit=dev lists the runtime packages, while those two SDKs are still bundled into out/main.
Written by the indexing model from the issue text.
Description
Problem
Found in the Oct 13 audit (at 704a0b7).
In package.json:150-197, several packages that run inside the application at runtime are listed under devDependencies rather than dependencies:
dompurify,marked,marked-highlight,highlight.js,diff2html,@xterm/xterm,@xterm/addon-fit(bundled into the renderer by Vite)@modelcontextprotocol/sdk,@anthropic-ai/claude-agent-sdk(bundled intoout/mainbecauseexternalizeDepsPlugin()only externalizesdependencies, as noted inelectron.vite.config.ts:19-22)
While the built app works because Vite bundles them, listing runtime libraries such as dompurify and marked under devDependencies means npm audit --omit=dev and production dependency scanners treat them as build-only tooling.
Fix
Move runtime dependencies to dependencies and pass { exclude: ['@modelcontextprotocol/sdk', '@anthropic-ai/claude-agent-sdk'] } to externalizeDepsPlugin() in electron.vite.config.ts so the MCP and Claude Agent SDKs are still tree-shaken into out/main without packaging their unused server dependencies.
- Dominant language
- TypeScript
- Stars
- 2
- Forks
- 2
- Avg merge
- 8h 28m
- Merged PRs (30d)
- 26
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from PierrunoYT/patch
-
security: isAppPageUrl checks devRendererUrl with startsWith instead of comparing parsed URL originsOpenpriority: low security severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
PierrunoYT/patch#300 ·
Maintainers usually reply within 1 day
-
Claude Code chats: tool calls made inside Claude Code subagents leave cards that end as "(stopped)"Openbug priority: low severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
PierrunoYT/patch#289 ·
Maintainers usually reply within 1 day
-
bug priority: medium severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
PierrunoYT/patch#285 ·
Maintainers usually reply within 1 day
-
priority: medium security severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
PierrunoYT/patch#283 ·
Maintainers usually reply within 1 day
-
performance priority: low severity: low
Difficulty 4/5 3-5 days Newbie friendliness 30/100
PierrunoYT/patch#306 ·
Maintainers usually reply within 1 day
All issues in PierrunoYT/patch
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Chocobozzz/PeerTube#7832 ·
Maintainers usually reply within 3 days
-
Pay to use?Open
Difficulty 1/5 Under an hour Newbie friendliness 66/100
darkreader/darkreader#16108 · 1 comment ·
Maintainers usually reply within 2 days
-
Add: Dak Nong TV SDOpencheck:passed streams:add
Difficulty 1/5 Under an hour Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
bug engine
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
frostney/GocciaScript#1746 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
agilepathway/label-checker#739 · 4 comments ·
Maintainers usually reply within 1 day