Remove unused dependencies obsidian-dataview, uuid, minimatch, and matcher
None of these packages are imported anywhere in the codebase. Dataview support was added in 602d25f for DQL 'TABLE' queries but the code was subsequently removed without dropping the dependency; uuid, minimatch, and matcher have no remaining references at all. @types/uuid goes with uuid. Beyond the dead weight, these were the source of a disproportionate share of the project's outstanding vulnerability advisories. obsidian-dataview pulls in obsidian-calendar-ui, which pins svelte 3.35 (nine advisories, including the SSR XSS in GHSA-wv8q-r932-8hc7) and preact 10.26.7 (JSON VNode injection). uuid 8.x carries a missing buffer bounds check, and minimatch 5.x an old brace-expansion with four ReDoS/OOM advisories. Removing the packages resolves all of these outright rather than forcing a breaking upgrade of obsidian-dataview, which npm audit's suggested fix would have downgraded to 0.4.21. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A
Adam Coddington committed
a13b587151e0dc5bb1a281d61713c93143430e6a
Parent: fa50a39