[C. Spencer Beggs (spencerbeggs)]

Signed-off-by: C. Spencer Beggs spencer@savvyweb.systems

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​savvy-web/​bundler@​0.2.0
	@​savvy-web/​silk-effects@​1.0.0
	@​savvy-web/​silk@​0.4.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm entities is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: ? → npm/@savvy-web/silk@0.4.0 → npm/entities@4.5.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@4.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm string-width is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/@savvy-web/silk@0.4.0 → npm/string-width@8.1.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/string-width@8.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[savvy-web-bot]

Clean deprecation. Approving.

[savvy-web-bot]

Code Review

Current Commit: e79e20f

Summary

Well-executed deprecation PR. All five validation checks pass (Tests, Markdown, Code Quality, Conventional Commits, PR Title Validation). No previous review threads to resolve.

What's Here

Deprecation notices — Both README.md and package/README.md get a [!CAUTION] callout pointing users to @savvy-web/silk and the savvy CLI. The messaging is consistent and actionable.

Changeset — .changeset/gold-rice-dress.md correctly declares a major bump with clear migration steps. No newline at end of file is standard changeset behavior, not a defect.

Build toolchain migration — rslib.config.ts is removed in favor of package/savvy.build.ts using the new @savvy-web/bundler. The if (import.meta.main) guard is appropriate for dual-use (importable config + direct execution) and is supported in Node.js 24+.

Turbo config centralization — package/turbo.json collapses to {"extends": ["//"], "tasks": {}} and all task definitions move to the root turbo.json. The new pipeline is well-structured: build:dev → build:meta → build:prod, with types:check gating only production builds (a reasonable DX tradeoff).

package/README.md import fix — The old example incorrectly imported from @savvy-web/silk/commitlint; it's corrected to @savvy-web/commitlint. Good catch.

Notes

Socket security warnings — entities@4.5.0 and string-width@8.1.0 are flagged as "obfuscated code" via the @savvy-web/silk@0.4.0 dependency chain. Both are well-known, widely-audited packages; Socket's obfuscated-code detector routinely false-positives on minified bundles. No action needed, but the team should be aware and can triage via the Socket dashboard if preferred.

@savvy-web/silk-effects major bump — ^0.6.1 → ^1.0.0 is a major version jump in a runtime dependency. For a deprecated package shipping its final release this is fine, but worth a sanity-check that the source compiles cleanly against the new major (the passing Tests check provides confidence here).

Verdict

Everything is in order. Approved. ✓