Remove unused dependencies and add dependencies documentation#3463
Merged
Conversation
Add mandatory source file verification procedure that: - Gets ALL added/deleted files without path filtering first - Cross-references against BUILD.gn to identify what needs updating - Includes concrete example from libwebp 1.6.0 update This prevents build failures from missing new source files that were previously missed due to partial directory checks.
## Changes ### Documentation - Add documentation/dependencies.md with comprehensive dependency reference - Security-relevant dependencies (10) - GPU/graphics dependencies - Unused dependencies with reasons - Platform-specific usage - cgmanifest.json mapping ### Skills - Update security-audit skill to reference central docs - Update native-dependency-update skill to reference central docs ### Submodule - Update externals/skia to include DEPS cleanup (mono/skia#164) - Removes 18 unused dependencies - Retains 15 active dependencies ## Verification Local builds verified on macOS, iOS, and Android.
Contributor
|
Triage Summary Labels will be applied to indicate the affected components, including dependencies associated with SkiaSharp, Vulkan, and various operating systems (macOS, iOS, and Android), along with documentation. This issue is not identified as a regression, as it pertains to maintenance tasks rather than a loss of functionality or performance. Additional remarks:
Detailed Summary and ActionsSummary of the triage:
Summary of the actions that will be performed:
This entire triage process was automated by AI and mistakes may have been made. Please let us know so we can continue to improve. |
Change from 'git' type with mirror URLs to 'other' type with canonical upstream names and versions. This allows Microsoft Component Governance to properly match dependencies against CVE databases. Security-relevant dependencies now listed with canonical names: - libpng (1.6.44) - zlib (1.3.0.1) - libjpeg-turbo (2.1.5.1) - libwebp (1.3.2) - freetype (2.13.3) - harfbuzz (8.3.1) - libexpat (2.6.4) - brotli (1.0.9) - wuffs (0.3.3) - dng_sdk (1.6.0) Also includes GPU/graphics dependencies: - VulkanMemoryAllocator - SPIRV-Cross - D3D12MemoryAllocator Removed unused dependencies that are no longer in DEPS: - angle, icu, imgui, jsoncpp, lua, microhttpd, rapidjson, sdl, sfntly, spirv-headers, spirv-tools, swiftshader, googletest, buildtools, depot_tools, common
- Rewrote documentation/dependencies.md as comprehensive reference (~400 lines) - Security-relevant dependencies with CVE database names - Known false positives (MiniZip, FreeType zlib) - CVE verification process with git commands - cgmanifest.json format and mapping table - Platform-specific usage details - Build configuration and GN flags - Slimmed down skills to workflow-only content: - security-audit/SKILL.md: 344→130 lines (links to deps doc) - native-dependency-update/SKILL.md: 381→130 lines (links to deps doc) - Extracted report templates to references/report-template.md - Deleted known-exceptions.md (content moved to deps doc) - Updated cross-references: - copilot-instructions.md: added security-audit and native-dependency-update to skills table - documentation/README.md: added dependencies.md to reference section - documentation/building.md: added native build commands This implements Option D (minimal restructure) to eliminate duplication between skills and make dependencies.md the authoritative reference.
dependencies.md (367→115 lines): - Removed: unused deps list (already in DEPS comments), platform lists (redundant with tables), build configuration (internal detail), workflows (just links), version checking commands, adding/removing deps - Kept: active deps tables, cgmanifest format, known false positives - Added: TOC, cleaner tables security-audit skill (140→109 lines): - Simpler flowchart - Kept CVE verification here (it's a procedure, not reference) - Removed verbose mermaid diagram native-dependency-update skill (146→145 lines): - Removed duplicate notes column from table - Links to deps doc for cgmanifest details
- Step 1: Create mono/skia PR with SkiaSharp issue link - Step 2: Create SkiaSharp PR with skia PR link and Fixes # syntax - Step 3: Go back and update mono/skia PR with SkiaSharp PR link Matches the PR templates in both repos.
1 task
mattleibow
added a commit
that referenced
this pull request
Apr 28, 2026
Add missing 'removed unused dependencies' entry (#3463), update platform table, and add CI/docs summary line to preview section. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Remove 18 unused native dependencies from Skia's DEPS file and add comprehensive dependency documentation.
Changes
Documentation
documentation/dependencies.md- Comprehensive dependency reference including:Skills
security-auditskill to reference central documentationnative-dependency-updateskill to reference central documentationSubmodule (mono/skia#164)
Dependencies Removed
skia_use_libavif=falseskia_use_libgrapheme=falseskia_use_libjxl_decode=falseis_skia_dev_buildonlyskia_enable_vello_shaders=falseDependencies Retained (15)
brotli, d3d12allocator, dng_sdk, expat, freetype, harfbuzz, libjpeg-turbo, libpng, libwebp, piex, spirv-cross, vulkan-headers, vulkanmemoryallocator, wuffs, zlib
Verification
Local builds verified:
Related