메뉴
Reduce duplicate installs with overrides, hardened drop-ins, patches, consumer checks.
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/SocketDev/action --skill deduping-dependencies명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SOC 직업 분류 기준
SKILL.md 표시 중
| name | deduping-dependencies |
| description | Reduce duplicate installs with overrides, hardened drop-ins, patches, consumer checks. |
| user-invocable | true |
| allowed-tools | Bash(node:*), Bash(git:*), Bash(grep:*), Bash(rg:*), Bash(ls:*), Bash(pnpm install:*), Bash(pnpm patch:*), Bash(pnpm patch-commit:*), Read, Edit, Write |
| model | claude-sonnet-4-6 |
| context | fork |
| metadata | {"internal":true} |
Duplicate majors of a package in the install tree are dead weight: more bytes, more attack surface, and (for bundled outputs) bigger bundles. This skill collapses them safely — the hard part isn't finding duplicates, it's knowing which collapse is safe. That judgment is the decision tree below.
Three levers, in order of preference:
@socketregistry/* redirects — Socket-published, audited, API-transparent drop-ins for ubiquitous shims. Soak-exempt (Socket scope). Promote to the fleet-canonical overrides: (in scripts/repo/sync-scaffolding/manifest/catalog.mts → FLEET_CANONICAL_OVERRIDES) when present un-redirected in ≥6 repos and CJS-interop (won't break ESM consumers). Narrower ones stay repo-specific.overrides:.pnpm patch the new version to restore the old surface, then force unscoped.Classify the break between the lowest major present and the collapse target, then act:
| break kind | safe move | why |
|---|---|---|
none / same-major / data-only (e.g. mime-db, color-name, semver 7.x) | collapse unscoped to highest present | no consumer-visible change |
| CJS↔ESM format flip only, and the fleet bundles these deps (SEA / rolldown) | force the ESM major, unscoped | the bundler resolves CJS↔ESM interop at build time, so the runtime-require break can't happen — and ESM tree-shakes to smaller bundles. Forcing also collapses the CJS+ESM split. |
| non-format API break (callback→promise, removed method, changed signature) — bundling does not fix this | patch-for-compat then force, else scope | a bundler resolves module format, never an API contract. If a compat shim is feasible, pnpm patch the new version + force unscoped (max dedup). If not, scope the override ('name@>=N': 'X') to leave the incompatible major alone. |
The trap: "we bundle, so just force the newest ESM" is only true for format flips. isexe 2→4 looks like an ESM bump but is really a callback→promise API break — forcing it breaks which@2 regardless of bundling. Always classify format-vs-API before forcing.
Node floor is not the risk. The fleet runs Node 26+; any modern version's engines.node (18/20/22) is satisfied. Node-floor bumps are acceptable by default — they are never the reason to scope. The risks are only the two columns above.
Never assert safety — prove it:
package.json (type, exports, engines) for each version present (<repo>/node_modules/.pnpm/<pkg>@<ver>/node_modules/<pkg>/package.json). This decides format-flip vs not.chalk.styles/hasColor/stripColor (removed v2) had 0 fleet usage; the lone chalk.constructor/Instance user (@anthropic-ai/claude-code) bundles its own chalk and declares no chalk dep, so the override can't reach it → safe, no patch needed.which@2.0.2 calls isexe(p, opts, cb) (callback) and declares isexe: ^2.0.0 → the force breaks it → patch required.cross-spawn@7 declares which@^2.0.1 and calls which.sync(cmd, {path, pathExt}). which@7 is still CJS with a .sync reading the same opt.path/pathExt/nothrow surface, and the Node-floor bump is irrelevant → unscoped the which@>=4 override to which (no format flip, no API break). Runtime-confirmed: cross-spawn.sync resolved a command via which@7.type: module); the only consumers are the CJS yargs@17 cluster (cliui/string-width@4/wrap-ansi@7, pulled by @grpc/proto-loader) which require('strip-ansi') at runtime — not bundled. Force-ESM would break the require, and no strip-ansi version is both >6 and CJS → not collapsible (format flip + non-bundled CJS consumer); leave the duplicate.pnpm install --frozen-lockfile per repo before committing. A force that breaks resolution fails that gate and the cascade commits without the bad lockfile, surfacing loudly. Re-run it after any override change; a clean frozen pass means the tree is consistent.When a force is blocked by an API break and a shim is feasible:
pnpm patch <pkg>@<version> # opens an editable copy, prints its path
# edit the package's CJS/ESM entry to re-add the old surface (see below)
node -e '<load the patched entry; exercise the OLD API to prove it works>'
pnpm patch-commit <path> # writes patches/<pkg>@<ver>.patch + a patchedDependencies entry
Worked example — isexe@4.0.0 (restore the isexe@2 callable + callback signature). Appended to the CJS entry; makes require('isexe') callable and callback-aware while preserving isexe@4's promise behavior and named exports:
// compat shim: callable export + (path, options, callback) signature
;(function(){var e=module.exports,i=e.isexe;function isexe(p,o,c){if(typeof o==="function"){c=o;o=void 0}if(typeof c==="function"){Promise.resolve(i(p,o||{})).then(function(r){c(null,r)},function(x){c(x)});return}return i(p,o)}Object.assign(isexe,e);isexe.default=isexe;module.exports=isexe})();
Patches are fleet-canonical: the .patch lives under template/patches/ and patchedDependencies is cascaded with the override that forces the version — the two ship together: the patch is inert without the force, the force is unsafe without the patch.
@socketregistry redirects + version overrides → FLEET_CANONICAL_OVERRIDES in scripts/repo/sync-scaffolding/manifest/catalog.mts. catalog: overrides are valid only where the member's catalog carries that entry — bare names with no fleet-wide catalog entry (e.g. rolldown/vite/magic-string) must be a direct version pin or stay repo-specific, or pnpm trips ERR_PNPM_CATALOG_IN_OVERRIDES.template/patches/<pkg>@<ver>.patch + patchedDependencies (cascaded).socket-wheelhouse, run socket-wheelhouse/scripts/repo/sync-scaffolding/cli.mts --target . --fix to dogfood-cascade, then the fleet wave. Validate the bundled-output repos with an actual build (bundling makes format safe; the build proves the API is too).updating skill / weekly-update.yml): re-run the dedup scan, promote newly-clearable @socketregistry drop-ins, collapse new same-major duplicates.tidying-*): a dedup pass is part of shrinking the install + bundle.scripts/fleet/check/ invariant flags avoidable cross-major duplicates. When the decision tree says a dup family is collapsible but it isn't pinned, the check fires, so the fleet doesn't silently re-accumulate them.# duplicate families (>1 major) + un-redirected @socketregistry drop-ins
node scripts/fleet/check/dependencies-are-deduped.mts
The scan is mechanical (parse pnpm-lock.yaml packages: keys → group by name → flag >1 major + cross-reference the overrides: drop-in set). The judgment, the decision tree + verification, is where care goes: fan out one analysis per package family for a large sweep, each grounding its verdict in the on-disk manifest + a consumer-grep.