From 20103220d97094ceb8722ab5d9651e60fba1ca44 Mon Sep 17 00:00:00 2001
From: ARUNAVO RAY <developer@arunavoray.dev>
Date: Sat, 16 May 2026 12:03:53 +0530
Subject: [PATCH] chore: prune npm overrides that are no longer load-bearing
 (#290)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Removed 5 overrides whose constraints have since been picked up naturally
by the transitive dep graph. Verified by removing each and confirming the
resolved version (and the dep tree) is identical to what the override
produced:

- defu ^6.1.7 → still resolves 6.1.7
- fast-xml-parser ^5.5.6 → still resolves 5.5.6
- node-forge ^1.3.3 → package not in tree at all (override was dead)
- rollup >=4.59.0 → still resolves 4.59.0
- svgo ^4.0.1 → still resolves 4.0.1

Kept overrides that are still doing real work:

- @esbuild-kit/esm-loader → npm:tsx@^4.21.0 — deliberate replacement shim
- @xmldom/xmldom ^0.8.13, devalue ^5.8.1, fast-uri ^3.1.2,
  fast-xml-builder ^1.1.7, kysely ^0.28.17 — active CVE pins (#289)
- lodash ^4.18.1 — pins to the newer 4.18.x line over the legacy 4.17.x
  that transitive deps still pull
- picomatch ^4.0.4 — without it, picomatch@2.3.2 is added as a duplicate
  copy via a transitive that asks for 2.x

Future drift would be caught by Dependabot + the weekly Docker Scout
scan; the overrides above remain because they currently affect the tree.
---
 bun.lock     | 5 -----
 package.json | 7 +------
 2 files changed, 1 insertion(+), 11 deletions(-)

diff --git a/bun.lock b/bun.lock
index 0967a20..abf7152 100644
--- a/bun.lock
+++ b/bun.lock
@@ -83,17 +83,12 @@
   "overrides": {
     "@esbuild-kit/esm-loader": "npm:tsx@^4.21.0",
     "@xmldom/xmldom": "^0.8.13",
-    "defu": "^6.1.7",
     "devalue": "^5.8.1",
     "fast-uri": "^3.1.2",
     "fast-xml-builder": "^1.1.7",
-    "fast-xml-parser": "^5.5.6",
     "kysely": "^0.28.17",
     "lodash": "^4.18.1",
-    "node-forge": "^1.3.3",
     "picomatch": "^4.0.4",
-    "rollup": ">=4.59.0",
-    "svgo": "^4.0.1",
   },
   "packages": {
     "@acemir/cssom": ["@acemir/cssom@0.9.31", "", {}, "sha512-ZnR3GSaH+/vJ0YlHau21FjfLYjMpYVIzTD8M8vIEQvIGxeOXyXdzCI140rrCY862p/C/BbzWsjc1dgnM9mkoTA=="],
diff --git a/package.json b/package.json
index 96ef340..4c3c6c0 100644
--- a/package.json
+++ b/package.json
@@ -46,17 +46,12 @@
   "overrides": {
     "@esbuild-kit/esm-loader": "npm:tsx@^4.21.0",
     "@xmldom/xmldom": "^0.8.13",
-    "defu": "^6.1.7",
     "devalue": "^5.8.1",
     "fast-uri": "^3.1.2",
     "fast-xml-builder": "^1.1.7",
-    "fast-xml-parser": "^5.5.6",
     "kysely": "^0.28.17",
     "lodash": "^4.18.1",
-    "node-forge": "^1.3.3",
-    "picomatch": "^4.0.4",
-    "rollup": ">=4.59.0",
-    "svgo": "^4.0.1"
+    "picomatch": "^4.0.4"
   },
   "dependencies": {
     "@astrojs/check": "^0.9.7",