From e2e65423e45366dd1aa447c3919ba69895edb02f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 8 Sep 2026 20:22:09 +0000
Subject: [PATCH] Drop the dependenciesMeta build exceptions

All three turned out to be unnecessary. They were added because Yarn
listed them as having build scripts, not because the scripts do anything
this project needs:

- @parcel/watcher's install script is `node scripts/build-from-source.js`,
  whose entire body is guarded by `npm_config_build_from_source === 'true'`.
  Nothing sets that, so it is a literal no-op; the native binding comes from
  the prebuilt @parcel/watcher-<platform> optional dependency.
- @swc/core's postinstall only validates that the native binding loads and,
  if it does not, shells out to `npm install @swc/wasm` as a fallback. With
  the optional dependency present it returns immediately.
- esbuild's postinstall skips its one real action (relinking the bin shim to
  the native binary) when `isYarn()`, which is always true here. What remains
  is a version assertion between esbuild and @esbuild/<platform>, both of
  which the lockfile already pins together.

Verified by loading each one after an install with scripts disabled: the
esbuild JS API and CLI, the @swc/core native binding, and @parcel/watcher's
subscribe all work. Full `yarn check` and an `electron-builder --linux dir`
pack pass with no exceptions granted.

The YN0004 warnings that remain are informational. CONTRIBUTING now says to
read the script before granting an exception rather than reflexively adding
one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BtCagWFcr4MLHQD4zkPVf5
---
 CONTRIBUTING.md | 19 ++++++++++++-------
 package.json    | 11 -----------
 yarn.lock       |  7 -------
 3 files changed, 12 insertions(+), 25 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 51aa7cc7..add5fa88 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -178,12 +178,16 @@ yarn upgrade-interactive
 ```
 
 Install scripts are disabled by default (`enableScripts: false` in `.yarnrc.yml`), so a
-compromised dependency cannot run code just by being installed. Packages that genuinely need
-to build something at install time are opted in individually under `dependenciesMeta` in
-`package.json`.
+compromised dependency cannot run code just by being installed. No package currently needs an
+exception.
 
-If an install prints `YN0004: <package> lists build scripts, but all build scripts have been
-disabled`, decide whether that package really needs to build. If it does, add it:
+Installs print `YN0004: <package> lists build scripts, but all build scripts have been
+disabled` for packages whose scripts were skipped. That warning is not by itself a problem —
+most install scripts in modern packages are no-ops that only matter when a prebuilt native
+binary is missing, and some are explicitly skipped under Yarn anyway. Before granting an
+exception, read the script and check whether the package actually works without it.
+
+If it genuinely needs to build, opt that one package in:
 
 ```json
 "dependenciesMeta": {
@@ -191,8 +195,9 @@ disabled`, decide whether that package really needs to build. If it does, add it
 }
 ```
 
-Ignoring the warning leaves the package unbuilt, which usually surfaces later as a confusing
-runtime failure rather than an install error.
+Prefer verifying over granting: a package that silently fails to build usually surfaces as a
+confusing runtime error, but a blanket `enableScripts: true` gives every dependency in the
+tree the right to execute code at install time.
 
 ### i18n strings / Weblate
 
diff --git a/package.json b/package.json
index 9c87e810..93037d19 100644
--- a/package.json
+++ b/package.json
@@ -161,17 +161,6 @@
     "yargs-parser": "^22.0.0",
     "zod": "^4.4.3"
   },
-  "dependenciesMeta": {
-    "@parcel/watcher": {
-      "built": true
-    },
-    "@swc/core": {
-      "built": true
-    },
-    "esbuild": {
-      "built": true
-    }
-  },
   "build": {
     "toolsets": {
       "appimage": "1.0.3"
diff --git a/yarn.lock b/yarn.lock
index 0ca38453..92eca2f7 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -9957,13 +9957,6 @@ __metadata:
     yargs: "npm:^18.0.0"
     yargs-parser: "npm:^22.0.0"
     zod: "npm:^4.4.3"
-  dependenciesMeta:
-    "@parcel/watcher":
-      built: true
-    "@swc/core":
-      built: true
-    esbuild:
-      built: true
   languageName: unknown
   linkType: soft