[43081j]

Part of tidying up dependencies, supply chain security, etc.

This replaces rimraf (7MB, 9 packages) with premove (9.7KB, 1
package).

node:fs can do this itself but it is convenient having a CLI for the
various package scripts. So premove is a thin wrapper around it for
that purpose.

NOTE: Alternatively we can roll our own workspace-root script that does the
same job as premove. Either works.

---

Why: Supply chain security, dependency tree reduction.

How to review: Ensure package scripts still work as expected.

Unsure about: N/A

[andreiborza]

Hi @43081j, thanks for the PR but there's no issue for this and we aren't really concerned with rimraf at the moment.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 0a88f4d. Configure here.}

[cursor]

globSync unavailable on supported Node 20

Medium Severity

The new clean scripts import globSync from node:fs, which was added in Node 22 and was not backported. These packages still declare engines.node including >=20.19.0, so clean (and browser-integration-tests pretest, which runs clean) throws globSync is not a function or a missing-export error on Node 20.

Additional Locations (2)

• dev-packages/e2e-tests/scripts/clean-test-applications.mjs#L1-L8
• dev-packages/node-integration-tests/scripts/clean.js#L1-L6

 

^{Reviewed by Cursor Bugbot for commit 0a88f4d. Configure here.}

[43081j]

hmm yeah not the best interaction today! anything more than "not interested" would be much appreciated given this is a no-brainer change there's barely any justification against.

i will create an issue and we can pick this back up.

[andreiborza]

From my perspective, we'd replace one dependency that's somewhat in our control (@isaacs is part of our team) with a third-party dependency that isn't in our control. I appreciate the desire to help and reduce deps, rimraf is just not one of them.

We also recently updated our contribution guide to ask external contributors to have a conversation with us before contributing because we are getting way too many recently and it's hard to juggle all that plus the team's work.

[43081j]

From my perspective, we'd replace one dependency that's somewhat in our control (@isaacs is part of our team) with a third-party dependency that isn't in our control. I appreciate the desire to help and reduce deps, rimraf is just not one of them.

imagine I rework this PR to use node:fs directly. then what? The <10 lines of code would be in your control and are the only part of rimraf you use today. Would you still choose to pull 7MB of code in to do the same job?