[jpan-box]

Overview

Thirteen devDependencies come out of the install because nothing in this repo names them. Before, yarn install fetched each one from its own line in package.json. The CDN webpack build and the published es/ output do not import them, so a parent install is unchanged apart from a shorter package.json.

• Blast radius: this repo's dev install and yarn.lock. The peer list is unchanged.
• Risk: @types/classnames was the types package TypeScript loaded for classnames. classnames already ships its own types. If a file depended on the stub's older shape, lint:ts fails.

What

• yarn install no longer fetches @formatjs/intl-pluralrules, @types/puppeteer, @types/classnames, @types/webpack, babel-plugin-rewire, intl, ts-loader, webpack-dev-server, or the direct stylelint-config-standard line.
• @babel/helper-create-class-features-plugin, @babel/template, @babel/types, and intl-messageformat-parser lose their direct lines and stay installed, because another package already depends on them.
• stylelint-config-standard-scss still depends on stylelint-config-standard 36, which is the range @box/frontend peers.

Why

• No source file, script, Storybook file, or config imports these packages.
• They are not peers of this package, and no shared-feature build imports them.
• A direct devDependency that nothing imports does not change the CDN bundle or the Babel es/ output.

How

• yup, the @dnd-kit packages, highlight.js, and remarkable stay. This repo does not import them, and the published shared-feature files do. Taking yup out made the CDN webpack build stop with Can't resolve 'yup' from @box/metadata-template-editor.
• @types/webpack goes because webpack 5 ships types.d.ts. Storybook imports Configuration from webpack, not from @types/webpack.
• Start in package.json devDependencies.

Detail, verification, and deferred work

• LANGUAGE=en-US REACT=true yarn build:prod:dist and LANGUAGE=en-US REACT=false yarn build:prod:dist both finished on this tree. The thirteen names are absent from the JavaScript those builds emit.
• npm pack --dry-run went from 50,468,087 bytes to 50,468,001 bytes compressed, and from 240,153,158 bytes to 240,152,625 bytes unpacked. The file count stayed 14,739. That is the shorter package.json.
• yarn build:prod:es compiled 2366 files. yarn build:i18n finished. yarn test --changedSince=upstream/master found no tests for this package.json and yarn.lock change.
• Parent application builds were not run.

Summary by CodeRabbit

• Chores
  • Updated the project’s development setup. No end-user-facing changes are included in this update.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​highlight.js@​11.10.0 ⏵ 11.12.0	+1

View full report

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Files ignored due to path filters: 1

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: db58690e-69cf-465e-9431-3486a1d8f298

Commits

Reviewing files that changed from the base of the PR and between 0f023c4 and 8c794b6.

Files ignored due to path filters: 1

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

No actionable comments were generated in the recent review.

Walkthrough

The change removes 13 development dependency entries from package.json. The removed packages include Babel, FormatJS and Intl, type packages, Stylelint, and webpack tooling.

Changes

Development Dependency Cleanup

Layer / File(s)	Summary
Remove development dependencies package.json	Removes the listed Babel, FormatJS/Intl, type, Stylelint, and webpack development dependencies. Other entries in the affected ranges remain unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Possibly related PRs

• box/box-ui-elements#4910: Changes the localization build process and removes the old babel-plugin-react-intl path; this PR also removes related FormatJS and legacy Intl development dependencies.

Suggested reviewers: tjuanitas

Merge Risk: Minimal · previous review 0f023

No actionable merge-blocking issue was identified. The checked TypeScript workflow remains working after the dependency cleanup.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: removing unused development dependencies.
Description check		The description is complete and relevant. It explains what changed, why it changed, the affected scope, risks, verification performed, and deferred parent application builds.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the package list,
And finds a few old names dismissed.
Babel hops, Intl takes flight,
The toolchain trims its load tonight.
Then quiet paws review the diff.}

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 006bc1e1-359d-4960-982c-28181ddb70e7

Commits

Reviewing files that changed from the base of the PR and between 20aea28 and 0f023c4.

Files ignored due to path filters: 1

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

Files selected for processing: 1

• package.json

Files with no reviewable changes: 1

• package.json

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

[jpan-box]

• Already included in @babel/plugin-transform-class-properties and the other class transform plugins, no need to declare explicitly

[jpan-box]

• Already included in @babel/core, no need to declare explicitly

[jpan-box]

• Already included in @babel/core, no need to declare explicitly

[jpan-box]

• Not used in src, scripts, the webpack config, the Babel config, or Storybook

[jpan-box]

• classnames already ships index.d.ts, no need to declare @types/classnames

[jpan-box]

• Not used in src, scripts, the webpack config, the Babel config, or Storybook

[jpan-box]

• Already included in intl-messageformat, no need to declare explicitly

[jpan-box]

• Already included in stylelint-config-standard-scss, no need to declare explicitly

[jpan-box]

• Not used in src, scripts, the webpack config, the Babel config, or Storybook

[jpan-box]

• Not used in src, scripts, the webpack config, the Babel config, or Storybook

[tjuanitas]

looks good. do you see any warnings during a yarn install that says missing peer dependencies for these removed packages? sometimes this repo might not directly use the package but it could be a peer dependency of a package like @box/frontend

[mergify]

✅ Merged into master as e33e415 at 18:33 UTC

30 min in the queue, 10 min of it CI.

So far

• ✅ Entered the queue Tue 3 Nov, 18:02 · rule Automatic strict merge · triggered by rule Automatic merge queue
• ✅ Passed · in place
• ✅ Merged 18:33 · e33e415 · squash

5 merge conditions met

• github-review-approved · required by GitHub branch protection
• any of · required by GitHub branch protection:
  • check-success = Summary
  • check-neutral = Summary
  • check-skipped = Summary
• any of · required by GitHub branch protection:
  • check-success = lint_test_build
  • check-neutral = lint_test_build
  • check-skipped = lint_test_build
• any of · required by GitHub branch protection:
  • check-success = license/cla
  • check-neutral = license/cla
  • check-skipped = license/cla
• any of · required by GitHub branch protection:
  • check-success = lint_pull_request
  • check-neutral = lint_pull_request
  • check-skipped = lint_pull_request

_{Times in UTC · dashboard · how the merge queue works}