Remove stale leaflet/basecoat rows from the dependency review log - #669
Merged
Conversation
leaflet and @pokle/basecoat were copied forward from prior entries into the 2026-08-23 entry, but neither exists in any package.json, bun.lock, or source file in this repo any more. Caught while auditing the log for stale dependency references more broadly (fixed separately for historical entries). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xs5DzKKdqznSNF1WFjZepj
Both packages have been fully gone from package.json, bun.lock, and the source tree for a while, but the log's "Packages Not Upgraded" tables kept copying their rows forward unverified. @pokle/basecoat was removed by the 2026-07-27 RAC migration; leaflet was real as recently as the 2026-05-03 entry (which fixed an actual leaflet-provider.ts) but has since been fully replaced by mapbox-provider.ts with no entry ever logging the migration. Fixes the two most recent entries where I can confirm with confidence that the removal predates the entry (2026-08-09, 2026-08-02); earlier entries are left as-is since the exact leaflet removal date can't be pinned down without rewriting history on a guess. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xs5DzKKdqznSNF1WFjZepj
|
Preview Deployment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #668. While answering a question about whether
@pokle/basecoatis still a real dependency, I found it isn't — and thatdocs/dependency-review-log.md's "Packages Not Upgraded (intentional)" tables have been silently copying that row (and aleafletrow) forward for months without anyone re-verifying them against the actual tree.@pokle/basecoat— a companion to the shadcn/Base UI kit, gone since the RAC migration finished 2026-07-27 (perCLAUDE.md). It kept appearing in the "Not Upgraded" table in the 2026-08-02 and 2026-08-09 entries anyway, after that migration had already removed it.leaflet— genuinely was a real dependency once: the 2026-05-03 entry documents an actual CVE-2025-69993 XSS fix applied to a realleaflet-provider.tsfile. That file, and every other trace of leaflet, are gone from the current tree (replaced bymapbox-provider.ts) — but no entry between 2026-05-03 and today ever logged the removal or migration, so the "Not Upgraded" row for it just kept getting carried forward unchanged.Both rows are confirmed absent from every
package.json,bun.lock, and the source tree today.Scope: this fixes the 2026-08-09 and 2026-08-02 entries, the two most recent ones where I can say with confidence the rows were already stale at the time (both migrations/removals predate those entries). Earlier entries (2026-07-26 back through 2026-04-12) also carry the same
leafletrow, but I can't pin down exactly when between 2026-05-03 and 2026-07-26 it was actually removed — rewriting those on a guess would just trade one inaccuracy for another, so I left them as legitimate history. Each edited entry gets a short "[Retroactive correction, 2026-08-24]" note in its own Lessons section so a reader diffing against git blame isn't confused about why old-looking content changed.This is a documentation-only change — no code, dependency, or lockfile changes.
Test plan
docs/dependency-review-log.md.Generated by Claude Code