[dominic-clerk]

Description

Stacked on #10484. Drops dev dependencies that overlap with something the repo already requires. Lockfile drops 15 resolved packages (npm-run-all's tree, incl. string.prototype.padend, cross-spawn@6, read-pkg@3); nothing added or upgraded.

• @clerk/backend: npm-run-all → pnpm a && pnpm b (same pattern as ui's build). A failing test:node still stops before test:edge-runtime.
• root: uuid → randomUUID from node:crypto in integration/testUtils/handshake.ts
• root: cross-spawn / @types/cross-spawn had no importers; execa and zx cover process spawning

Kept on purpose: execa (integration harness relies on its reject/cleanup semantics), chalk/fs-extra (already pulled transitively or vendored by zx, no savings), expo's base-64 (replaces Hermes' broken atob/btoa, which shared's helpers call), tsup/tsdown and jsdom/happy-dom (would change build output or test behavior).

Part of SEC-493

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: b49f022

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 28, 2026 9:10am UTC
swingset	Ready	Preview	Oct 28, 2026 9:10am UTC

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: clerk/javascript
• Branch: dominic/sec-493-consolidate-overlapping-deps
• File: .coderabbit.yaml
• Commit: b49f022
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Team
• Run ID: b8f5535f-095a-4ec9-971f-fbf48b40d9be

Commits

Reviewing files that changed from the base of the PR and between f46f7ec and b49f022.

Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 4

• .changeset/consolidate-overlapping-dev-dependencies.md
• integration/testUtils/handshake.ts
• package.json
• packages/backend/package.json

Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• clerk/clerk_go (manual)
• clerk/dashboard (manual)
• clerk/accounts (manual)
• clerk/backoffice (manual)
• clerk/clerk (manual)
• clerk/clerk-docs (manual)
• clerk/cloudflare-workers (manual)
• clerk/clerk-android (auto-detected)
• clerk/clerk-ios (auto-detected)
• clerk/cli (auto-detected)

Files with no reviewable changes: 1

• package.json

Included review availability: This review used your included allowance. 6 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 8 reviews per hour.

Walkthrough

Integration test configuration now uses randomUUID() from node:crypto to generate identifiers. Root development dependencies remove uuid, cross-spawn, and @types/cross-spawn. Backend test scripts use && to run Node and edge-runtime commands in sequence, and backend development dependencies remove npm-run-all. The changeset file contains empty frontmatter delimiters.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: wobsoriano

Merge Risk: Minimal · up to b49f0

The dependency cleanup is mergeable with no identified compatibility, runtime, or data risk.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely summarizes the main change: consolidating overlapping development dependencies.
Description check		The description directly explains the dependency removals, replacement of uuid and npm-run-all, retained dependencies, and validation results.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 1 files. (2 skipped: 2 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Linked repositories: Some configured repositories could not be included in this review. Cross-repository analysis may be incomplete. Please check linked-repository access and settings.

_{Comment @coderabbitai help to get the list of available commands.}