Remove unused dependencies from DEPS - #164
Merged
Merged
Conversation
Comment out 18 dependencies that SkiaSharp doesn't use: - abseil-cpp (Dawn/WebGPU only) - egl-registry (no BUILD.gn refs) - highway (libjxl only, disabled) - imgui (viewer tool only) - libavif (skia_use_libavif=false) - libgav1 (libavif dependency) - libgrapheme (skia_use_libgrapheme=false) - libjxl (skia_use_libjxl_decode=false) - libyuv (libavif dependency) - microhttpd (skiaserve tool only) - oboe (audioplayer/viewer only) - opengl-registry (no BUILD.gn refs) - spirv-headers (spirv-tools dependency, dev builds) - spirv-tools (is_skia_dev_build only) - vello (skia_enable_vello_shaders=false) - vulkan-deps (meta-repo, not directly used) - vulkan-tools (debugging tools only) - vulkan-utility-libraries (debugging only) This reduces attack surface and sync time for SkiaSharp builds. Verified builds pass on macOS, iOS, and Android.
mattleibow
added a commit
to mono/SkiaSharp
that referenced
this pull request
Jan 27, 2026
## Changes ### Documentation - Add documentation/dependencies.md with comprehensive dependency reference - Security-relevant dependencies (10) - GPU/graphics dependencies - Unused dependencies with reasons - Platform-specific usage - cgmanifest.json mapping ### Skills - Update security-audit skill to reference central docs - Update native-dependency-update skill to reference central docs ### Submodule - Update externals/skia to include DEPS cleanup (mono/skia#164) - Removes 18 unused dependencies - Retains 15 active dependencies ## Verification Local builds verified on macOS, iOS, and Android.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Comment out 18 dependencies that SkiaSharp doesn't use to reduce attack surface and sync time.
Dependencies Removed
skia_use_libavif=falseskia_use_libgrapheme=falseskia_use_libjxl_decode=falseis_skia_dev_buildonlyskia_enable_vello_shaders=falseDependencies Retained (15)
brotli, d3d12allocator, dng_sdk, expat, freetype, harfbuzz, libjpeg-turbo, libpng, libwebp, piex, spirv-cross, vulkan-headers, vulkanmemoryallocator, wuffs, zlib
Verification
Local builds verified on:
SkiaSharp PR
mono/SkiaSharp#3463