Skip to content

Remove unused dependencies and add dependencies documentation#3463

Merged
mattleibow merged 10 commits into
mainfrom
dev/remove-unused-deps
Jan 27, 2026
Merged

Remove unused dependencies and add dependencies documentation#3463
mattleibow merged 10 commits into
mainfrom
dev/remove-unused-deps

Conversation

@mattleibow

Copy link
Copy Markdown
Collaborator

Summary

Remove 18 unused native dependencies from Skia's DEPS file and add comprehensive dependency documentation.

Changes

Documentation

  • New: documentation/dependencies.md - Comprehensive dependency reference including:
    • Security-relevant dependencies (10 total)
    • GPU/graphics dependencies
    • Unused dependencies with reasons for exclusion
    • Platform-specific usage details
    • cgmanifest.json mapping table

Skills

  • Update security-audit skill to reference central documentation
  • Update native-dependency-update skill to reference central documentation

Submodule (mono/skia#164)

  • Comment out 18 unused dependencies in DEPS
  • Retain 15 active dependencies

Dependencies Removed

Dependency Reason
abseil-cpp Dawn/WebGPU only (disabled)
egl-registry No BUILD.gn references
highway libjxl only (disabled)
imgui Viewer tool only
libavif skia_use_libavif=false
libgav1 libavif dependency
libgrapheme skia_use_libgrapheme=false
libjxl skia_use_libjxl_decode=false
libyuv libavif dependency
microhttpd skiaserve tool only
oboe audioplayer/viewer only
opengl-registry No BUILD.gn references
spirv-headers spirv-tools dependency (dev builds)
spirv-tools is_skia_dev_build only
vello skia_enable_vello_shaders=false
vulkan-deps Meta-repo, not directly used
vulkan-tools Debugging tools only
vulkan-utility-libraries Debugging only

Dependencies Retained (15)

brotli, d3d12allocator, dng_sdk, expat, freetype, harfbuzz, libjpeg-turbo, libpng, libwebp, piex, spirv-cross, vulkan-headers, vulkanmemoryallocator, wuffs, zlib

Verification

Local builds verified:

  • ✅ macOS (arm64)
  • ✅ iOS (all architectures)
  • ✅ Android (arm64)

Related

Add mandatory source file verification procedure that:
- Gets ALL added/deleted files without path filtering first
- Cross-references against BUILD.gn to identify what needs updating
- Includes concrete example from libwebp 1.6.0 update

This prevents build failures from missing new source files that were
previously missed due to partial directory checks.
## Changes

### Documentation
- Add documentation/dependencies.md with comprehensive dependency reference
  - Security-relevant dependencies (10)
  - GPU/graphics dependencies
  - Unused dependencies with reasons
  - Platform-specific usage
  - cgmanifest.json mapping

### Skills
- Update security-audit skill to reference central docs
- Update native-dependency-update skill to reference central docs

### Submodule
- Update externals/skia to include DEPS cleanup (mono/skia#164)
  - Removes 18 unused dependencies
  - Retains 15 active dependencies

## Verification

Local builds verified on macOS, iOS, and Android.
@github-actions

Copy link
Copy Markdown
Contributor

Triage Summary

Labels will be applied to indicate the affected components, including dependencies associated with SkiaSharp, Vulkan, and various operating systems (macOS, iOS, and Android), along with documentation.

This issue is not identified as a regression, as it pertains to maintenance tasks rather than a loss of functionality or performance.

Additional remarks:

  • The issue mainly focuses on housekeeping tasks such as removing unused dependencies and enhancing documentation, so no labels were deemed necessary for performance, compatibility, or reliability.
Detailed Summary and Actions

Summary of the triage:

  • The issue deals with cleaning up unused dependencies and updating documentation, specifically within the Skia project.
  • Relevant platforms affected include macOS, iOS, and Android.
  • The discussion involves both SkiaSharp and Vulkan functionalities, particularly in the context of local builds and dependencies.
  • The proposed actions emphasize the documentation aspect without directly touching on performance or compatibility issues.

Summary of the actions that will be performed:

Action Item Description
Apply Label backend/SkiaSharp The issue involves removing unused dependencies and updating documentation related to Skia.
Apply Label backend/Vulkan The issue discusses Vulkan-related dependencies and their usage within the Skia project.
Apply Label os/macOS The issue includes verification of local builds on macOS (arm64).
Apply Label os/iOS The issue mentions verification on iOS (all architectures).
Apply Label os/Android The issue references verification on Android (arm64).
Apply Label area/Docs The issue involves creating comprehensive dependency documentation.

This entire triage process was automated by AI and mistakes may have been made. Please let us know so we can continue to improve.

@github-actions github-actions Bot added area/Docs Issues relating to documentation, such as API docs or conceptual docs. backend/SkiaSharp backend/Vulkan os/Android os/iOS os/macOS labels Jan 27, 2026
Change from 'git' type with mirror URLs to 'other' type with canonical
upstream names and versions. This allows Microsoft Component Governance
to properly match dependencies against CVE databases.

Security-relevant dependencies now listed with canonical names:
- libpng (1.6.44)
- zlib (1.3.0.1)
- libjpeg-turbo (2.1.5.1)
- libwebp (1.3.2)
- freetype (2.13.3)
- harfbuzz (8.3.1)
- libexpat (2.6.4)
- brotli (1.0.9)
- wuffs (0.3.3)
- dng_sdk (1.6.0)

Also includes GPU/graphics dependencies:
- VulkanMemoryAllocator
- SPIRV-Cross
- D3D12MemoryAllocator

Removed unused dependencies that are no longer in DEPS:
- angle, icu, imgui, jsoncpp, lua, microhttpd, rapidjson, sdl,
  sfntly, spirv-headers, spirv-tools, swiftshader, googletest,
  buildtools, depot_tools, common
- Rewrote documentation/dependencies.md as comprehensive reference (~400 lines)
  - Security-relevant dependencies with CVE database names
  - Known false positives (MiniZip, FreeType zlib)
  - CVE verification process with git commands
  - cgmanifest.json format and mapping table
  - Platform-specific usage details
  - Build configuration and GN flags

- Slimmed down skills to workflow-only content:
  - security-audit/SKILL.md: 344→130 lines (links to deps doc)
  - native-dependency-update/SKILL.md: 381→130 lines (links to deps doc)

- Extracted report templates to references/report-template.md
- Deleted known-exceptions.md (content moved to deps doc)

- Updated cross-references:
  - copilot-instructions.md: added security-audit and native-dependency-update to skills table
  - documentation/README.md: added dependencies.md to reference section
  - documentation/building.md: added native build commands

This implements Option D (minimal restructure) to eliminate duplication
between skills and make dependencies.md the authoritative reference.
dependencies.md (367→115 lines):
- Removed: unused deps list (already in DEPS comments), platform lists
  (redundant with tables), build configuration (internal detail),
  workflows (just links), version checking commands, adding/removing deps
- Kept: active deps tables, cgmanifest format, known false positives
- Added: TOC, cleaner tables

security-audit skill (140→109 lines):
- Simpler flowchart
- Kept CVE verification here (it's a procedure, not reference)
- Removed verbose mermaid diagram

native-dependency-update skill (146→145 lines):
- Removed duplicate notes column from table
- Links to deps doc for cgmanifest details
- Step 1: Create mono/skia PR with SkiaSharp issue link
- Step 2: Create SkiaSharp PR with skia PR link and Fixes # syntax
- Step 3: Go back and update mono/skia PR with SkiaSharp PR link

Matches the PR templates in both repos.
@mattleibow
mattleibow merged commit 7c74e2f into main Jan 27, 2026
1 of 2 checks passed
@mattleibow
mattleibow deleted the dev/remove-unused-deps branch January 27, 2026 21:59
@mattleibow mattleibow mentioned this pull request Jan 31, 2026
5 tasks
@mattleibow mattleibow added the copilot Created by GitHub Copilot label Feb 2, 2026
mattleibow added a commit that referenced this pull request Apr 28, 2026
Add missing 'removed unused dependencies' entry (#3463), update platform
table, and add CI/docs summary line to preview section.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/Docs Issues relating to documentation, such as API docs or conceptual docs. backend/Vulkan copilot Created by GitHub Copilot os/Android os/iOS os/macOS

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

1 participant