Vendure dependency audit — change log

This document tracks the dependency footprint of Vendure across the stages of the dependency audit effort. Each stage records the state of the dependency graph after a discrete change (or batch of changes) has landed on this branch, so we can quantify the reduction in supply-chain surface area over time.

Issue reference

See #4761 for the full audit assessment, rationale, and prioritised plan. This document is the running ledger of how the dependency footprint shrinks as each stage lands.

How to add a stage

1. Land your changes (delete a dep, swap for a built-in, vendor a package, …).
2. Regenerate the lockfile (does not touch node_modules):
   bashCopy

   npm install --package-lock-only
   

3. Append a snapshot to this file:
   bashCopy

   node scripts/dependency-tracker/snapshot.mjs --stage="Stage N — <short description>" --append
   

4. Add a short prose ### Changes section below the snapshot explaining what was removed / replaced and why.
5. Commit the lockfile + this file together so the diff in CHANGES.md is reproducible.

For a machine-readable JSON snapshot (useful for scripting deltas):

node scripts/dependency-tracker/snapshot.mjs --json > /tmp/before.json
# ... make changes, regen lockfile ...
node scripts/dependency-tracker/snapshot.mjs --json > /tmp/after.json
diff /tmp/before.json /tmp/after.json

Stage 0 — Baseline (audit start)

• Commit: 51b439372 on chore/dependency-audit
• Date: 2026-05-21T07:20:14.801Z
• Total unique production packages: 1880

Per-Vendure-package transitive footprint

@vendure/core

@vendure/email-plugin

@vendure/asset-server-plugin

@vendure/admin-ui-plugin

@vendure/telemetry-plugin

@vendure/harden-plugin

@vendure/job-queue-plugin

@vendure/graphiql-plugin

@vendure/testing

@vendure/cli

@vendure/create

@vendure/dashboard

@vendure/ui-devkit

@vendure/admin-ui

Stage 1 — @types/nodemailer: pick up upstream AWS SDK removal

• Commit: 905ec160a on chore/dependency-audit
• Date: 2026-05-21T07:50:42.183Z
• Total unique production packages: 1807

Per-Vendure-package transitive footprint

@vendure/core

@vendure/email-plugin

@vendure/asset-server-plugin

@vendure/admin-ui-plugin

@vendure/telemetry-plugin

@vendure/harden-plugin

@vendure/job-queue-plugin

@vendure/graphiql-plugin

@vendure/testing

@vendure/cli

@vendure/create

@vendure/dashboard

@vendure/ui-devkit

@vendure/admin-ui

Changes

Bumped @types/nodemailer from ^6.4.9 to ^6.4.22 in both packages/email-plugin/package.json and the workspace root package.json (used by dev-server to satisfy EmailPlugin type resolution).

Why: @types/nodemailer versions 6.4.19 through 6.4.21 declared @aws-sdk/client-ses as a runtime dependencies entry, pulling ~76 AWS SDK and Smithy packages into every install that resolved the types — even consumers who never touch SES. This was a regression introduced upstream in DefinitelyTyped PR #73297 and flagged on discussion #74080 on 2025-11-14 — citing "the latest security issues on NPMJS" as the same supply-chain motivation that prompted our audit.

The fix landed upstream as DefinitelyTyped PR #74249 ("Remove AWS SDK from dependencies, use structural types") and shipped to npm as @types/[email protected] on 2026-01-26. Our existing spec floor of ^6.4.9 already permitted it; the lockfile had simply never been refreshed since. Bumping the floor to ^6.4.22 makes the fix mandatory and prevents a future refresh from silently regressing back to 6.4.21.

Caveat for future bumps: the 7.0.x line of @types/nodemailer still carries @aws-sdk/client-sesv2 as a runtime dep — the structural-types fix was backported to v6 and forward-ported to v8, but not to v7. Stay on v6 (or jump straight to v8) to keep the install clean.

Results:

Stage 2 — Remove body-parser direct dep from @vendure/core

• Commit: ca3d09390 on chore/dependency-audit
• Date: 2026-05-21T08:18:00.680Z
• Total unique production packages: 1807

Per-Vendure-package transitive footprint

@vendure/core

@vendure/email-plugin

@vendure/asset-server-plugin

@vendure/admin-ui-plugin

@vendure/telemetry-plugin

@vendure/harden-plugin

@vendure/job-queue-plugin

@vendure/graphiql-plugin

@vendure/testing

@vendure/cli

@vendure/create

@vendure/dashboard

@vendure/ui-devkit

@vendure/admin-ui

Changes

Removed body-parser from @vendure/core/package.json and updated the documented user-facing pattern in packages/core/src/common/types/common-types.ts (JSDoc on the Middleware interface) to recommend import { json } from 'express' instead of import { json } from 'body-parser'. Regenerated docs/docs/reference/typescript-api/common/middleware.mdx from the new JSDoc.

Why: body-parser was declared as a direct dependency of @vendure/core but never imported in source. Its only references were in JSDoc / generated docs telling users to use import { json } from 'body-parser' to override the JSON payload size limit. The JSDoc text "Vendure relies on the body-parser middleware to parse incoming JSON data" was true under the Express 4 / older NestJS stack but became inaccurate after the Express 5 / NestJS 11 / Apollo Server v5 upgrade — Vendure now relies on Express 5's built-in JSON parser, which re-exports body-parser v2 directly (exports.json = bodyParser.json in node_modules/express/lib/express.js). The documented express.json() is byte-identical in behaviour to body-parser.json().

Honest impact assessment. The repo-wide unique-package count did not move:

body-parser's 41-package subtree remains reachable through @apollo/server's bundled [email protected] (and via [email protected], which still appears as a non-dev parent in our admin-ui lockfile resolution). The supply-chain win is deferred to:

1. Apollo Server upgrade — once @apollo/server is bumped past its Express 4 internal pin (Apollo Server v5+ already supports this), the transitive pull of [email protected] disappears.
2. Admin-UI retirement (karma) — when the Angular admin-ui is fully retired in favour of the React dashboard.

This change still has standalone value:

• We no longer declare a dependency our code doesn't import.
• We're no longer pinning a body-parser version (^1.20.2) we don't control downstream.
• The JSDoc is now factually accurate about the current stack.
• The new documented pattern (import { json } from 'express') is the modern Express 5 idiom and doesn't require users to declare any extra dependency.

User-facing note. Users who copied the old import { json } from 'body-parser' snippet into their own configs will continue to work today because body-parser is still hoisted at top-level via the transitive parents above. Once those parents drop body-parser (deferred wins), a clean install will fail with Cannot find module 'body-parser' for those users. Recovery is a one-line swap to import { json } from 'express' (identical behaviour) or bun add body-parser (preserves the old pattern).

Audit lesson recorded. Per-direct-dep subtree counts (as reported by snapshot.mjs) overstate removal savings when subtrees overlap with those of other declared parents. The honest savings only show up in the union (transitiveTotal) when the last declared parent of a subtree is removed. Worth considering a future enhancement to the snapshot script: an "additive transitive" column that reports packages reachable only via a given direct dep.

Stage 3 — Drop node-fetch + form-data direct deps (native fetch/FormData)

• Commit: 324cc22f3 on chore/dependency-audit
• Date: 2026-05-21T09:02:58.355Z
• Total unique production packages: 1807

Per-Vendure-package transitive footprint

@vendure/core

@vendure/email-plugin

@vendure/asset-server-plugin

@vendure/admin-ui-plugin

@vendure/telemetry-plugin

@vendure/harden-plugin

@vendure/job-queue-plugin

@vendure/graphiql-plugin

@vendure/testing

@vendure/cli

@vendure/create

@vendure/dashboard

@vendure/ui-devkit

@vendure/admin-ui

Changes

Removed node-fetch@^2.7.0 and form-data@^4.0.0 from the workspace. Three call-sites were rewritten to use Node's built-in fetch, FormData, Blob, and AbortSignal.timeout (all available on the supported engine range ^20.19.0 || >=22.12.0):

Package-level changes:

• packages/testing/package.json: dropped node-fetch, form-data, @types/node-fetch.
• packages/asset-server-plugin/package.json: dropped node-fetch, @types/node-fetch (both devDependencies).
• packages/core: no package.json change — the node-fetch import in http-health-check-strategy.ts was never declared in dependencies. It had been working purely via Bun's flat-hoisted node_modules resolving a sibling-workspace copy. The native-fetch rewrite incidentally fixes that latent declaration bug.

Impact

• Workspace direct declarations of node-fetch / form-data / @types/node-fetch: 0 (down from 3 / 1 / 2 respectively).
• @vendure/testing published footprint: direct deps 8 → 6, unique transitive 34 → 7. Downstream users installing just @vendure/testing no longer pull either subtree.
• Repo-wide unique production package count: 1807 (unchanged) — same subtree-overlap effect observed in Stage 2:
  • [email protected] is still anchored by @apollo/server@4, cross-fetch, fbjs (via mjml), gaxios, web-resource-inliner.
  • [email protected] is still anchored by axios (mjml subtree) and by @types/node-fetch — which is itself only present because @apollo/server@4 declares it.

So the bulk transitive collapse for both packages is gated on the same Apollo Server v5 upgrade noted in the #4761 Apollo v5 comment. Once @apollo/server@5 lands (which itself is gated on @nestjs/apollo@14), @types/node-fetch, [email protected], and a chunk of the form-data subtree all drop in one cascade alongside body-parser.

The correctness win is independent and unconditional: our published packages no longer declare node-fetch or form-data at all, and the undeclared-dep latent bug in @vendure/core's deprecated health-check is fixed at the same time.

Stage final — after #4762-#4771 landed on minor

• Commit: c18f46f28 on minor
• Date: 2026-05-22T14:51:59.031Z
• Total unique production packages: 1735

Per-Vendure-package transitive footprint

@vendure/core

@vendure/email-plugin

@vendure/asset-server-plugin

@vendure/admin-ui-plugin

@vendure/telemetry-plugin

@vendure/harden-plugin

@vendure/job-queue-plugin

@vendure/graphiql-plugin

@vendure/testing

@vendure/cli

@vendure/create

@vendure/dashboard

@vendure/ui-devkit

@vendure/admin-ui

Changes

This is the closing snapshot of the supply-chain audit. The seven PRs that landed on minor between Stage 3 and here:

Closed without merging: #4766 (mjml optional peer). Deferred.

Results

Total unique production packages across the repo: 1,807 → 1,735 (−72).

Combined with Stages 0–3 (1,880 → 1,807, −73), the audit removed 145 unique production packages end-to-end — matching the ≈145 figure quoted in the issue baseline.

Per-Vendure-package transitive footprint (Stage 0 baseline → final):

Notes:

• @vendure/telemetry-plugin gained 7 direct deps (one per curated instrumentation) but shed 62 transitives — the trade is intentional: explicit declarations a maintainer can audit at a glance, in exchange for losing the Mongo / Kafka / Hapi / Cassandra / etc. subtrees that auto-instrumentations-node carried for libraries Vendure doesn't use.
• @vendure/core only shed 21 transitives despite removing four direct deps (body-parser, @nestjs/terminus, graphql-fields, progress). The terminus subtree (~295 packages quoted in the baseline) is mostly reachable through the rest of @nestjs/* and @apollo/server regardless — same overlap pattern documented for body-parser in Stage 2. The win is in direct attack surface, not raw transitive count.
• @vendure/testing is the biggest relative win: 34 → 9 unique transitives (−74%). Plugin authors writing e2e suites pull in dramatically less now.

Keep-decisions documented during the audit

Where the audit considered a dep and decided against removal:

• fs-extra — data-bearing-ish, subtree-overlap means modest saving, canonical-tier
• cross-spawn — security-sensitive (Windows .cmd shell-escape handling)
• dateformat — data-bearing (format-mask grammar)
• cron-time-generator — public API surface (typeof CronTime exposure to plugin authors)
• mime-types — data-bearing (IANA MIME registry snapshot, actively maintained upstream)
• cookie-session, graphql-upload, http-proxy-middleware — canonical implementations of wire/spec contracts where rolling our own carries security risk for marginal gain

The full reasoning is captured as comments on #4761 so future audits don't re-litigate.