Repository navigation
Remove unused frontend dependencies and PrimeNG modules - #159
Conversation
- Removed packages with no import, script, build, or runtime use: chart.js (only the unused primeng/chart and a global script), chokidar (kc_electron has its own), web-worker, ng-packagr, the duplicate eslint in kc_angular dependencies, and at the root @angular/cli, @angular-devkit/architect, eslint, eslint-plugin-html, and the root eslintConfig that no script ran. - Removed 18 PrimeNG modules that no template uses (Accordion, BlockUI, Carousel, Chart, ConfirmPopup, DataView, FileUpload, Menubar, OrganizationChart, PickList, ProgressSpinner, Sidebar, SplitButton, Splitter, TabView, Tag, ToggleButton, TreeTable). - MessagesModule and ProgressBarModule are now imported directly; they came in only through FileUploadModule before. - TypeScript is a devDependency of kc_angular only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
RobRoyce
left a comment
RobRoyce
left a comment
There was a problem hiding this comment.
Focused integration review of PR #159 at 6ee979b2615db242ca6525bb7d0ccc36d563479f.
No confirmed blocking finding in the combined revival stack. The independent code review checked storage writes, schema migration, managed files, backup/restore, local authentication, session recovery, Electron startup, and dependency removal. Main's conflicts were resolved without downgrading the stack's dependencies. All original commits are preserved.
Validation on the combined stack at 6ee979b2615db242ca6525bb7d0ccc36d563479f, using Node.js 24.21.0 in an isolated checkout:
- Clean immutable dependency install: passed.
- Development build and storage type check: passed.
- Unit tests: 8 passed.
- Storage tests: 35 passed.
- Hidden-window desktop tests: 4 passed.
- Headless Chrome tests: 6 passed.
- Unsigned production package and packaged workflow: passed (1 test).
Each historical intermediate branch was not rebuilt independently. Signing, live AI credentials, other operating systems, and broad dependency security auditing are outside this review.
This is a review record submitted through the PR author's account, not the independent approving review required by main's branch protection. CodeQL status is reported separately by GitHub.
|
CodeQL result clarification before integration: the analysis jobs succeeded, but the separate results check reports 21 new alerts on the legacy base PR (3 critical and 18 high). Successful analysis is not a clean security result. A focused review of final stack commit 6ee979b found no additional merge blocker for the current local desktop scope. Later commits bind chat to an ephemeral loopback port and require a random bearer token before parsing requests. Storage, migration, and restore validate record IDs. The model has no filesystem or network execution tools. Residual risks remain and are not dismissed as false positives: URL fetching can reach private networks through user-selected URLs or redirects; legacy file metadata from an untrusted backup can cause local file reads; chat cache paths need their own ID validation; source text and summaries appear in system messages; authenticated workloads lack rate limits. These require focused hardening during backend extraction, before hosted or multi-user use. Authentication does not make imported records trustworthy. The merge uses the repository owner's explicit administrator-override authorization. Alerts remain open and branch protection remains unchanged. The 54 passing functional tests do not constitute a security certification. |
1 participant
Remove unused frontend and root packages, redundant tooling, and 18 unused PrimeNG modules. Import MessagesModule and ProgressBarModule directly and keep frontend TypeScript in the Angular workspace.
This PR covers committed dependency cleanup and main integration. It does not complete the Angular or PrimeNG version upgrade. Later local commits and uncommitted upgrade work are outside this review.
Depends on #158. Merge the stack in order with merge commits, retargeting each next PR to main after its predecessor lands. Do not squash or delete intermediate branches during integration.
Validation on the combined stack at
6ee979b2615db242ca6525bb7d0ccc36d563479f, using Node.js 24.21.0 in an isolated checkout:Each historical intermediate branch was not rebuilt independently. Signing, live AI credentials, other operating systems, and broad dependency security auditing are outside this review.
Focused review found no confirmed blocker in the combined stack. The review covers basic workflows, data preservation, authentication, and the dependency changes. Broader modernization remains separate work.