axios and lodash are unused production dependencies carrying high-severity vulnerabilities

[rosscado]

Problem: axios (^1.4.0) and lodash (^4.17.21) are listed as direct production dependencies in package.json, and npm audit --omit=dev (2026-09-07 weekly maintenance routine) flags both at high severity — axios has ~30 open advisories (SSRF via NO_PROXY bypass, prototype-pollution gadgets enabling credential/request hijacking, ReDoS, DoS), lodash has code-injection via _.template and prototype pollution via _.unset/_.omit. Neither package appears to be imported anywhere in the repository.

Scope: Checked src/, entrypoints/, scripts/, and test/ for any import ... from 'axios'/'lodash' or require(...) — zero matches (src/utils/debounce.ts only mentions lodash in a comment: "lightweight alternative to lodash.debounce, reducing bundle size"). If genuinely unused, they contribute dead weight to npm install/npm audit surface and CI signal noise without being reachable from either the shipped extension bundle or any build/dev script. Out of scope: whether other flagged packages (express, http-proxy-middleware, serve-handler — used by server.js/npm start, Node-side dev tooling only) should also be revisited; not filed here as they're at least genuinely used, just not bundle-shipped.

Reproduction / verification:

1. grep -rn "from ['\"]axios['\"]\|require(['\"]axios['\"])" and the equivalent for lodash across src/, entrypoints/, scripts/, test/ (excluding node_modules, .git, .output, .wxt) — no hits.
2. npm ls axios lodash shows both listed only as top-level dependencies in package.json, not required by any other declared dependency as their sole consumer within this repo's own code.
3. npm audit --omit=dev --json shows axios and lodash both severity: "high", both fixAvailable: true.

Expected: production dependencies are either actually used by the shipped code/scripts, or removed. Actual: two high-severity-vulnerable packages sit in dependencies unused.

Acceptance criteria:

• Confirm (via a repo-wide reference search, including dynamic require/import() patterns this issue's grep may have missed) that axios and lodash are truly unreachable from any shipped code path or build/dev script.
• If confirmed unused: remove both from package.json dependencies and regenerate the lockfile; npm audit --omit=dev should then show zero findings attributable to either. This eliminates the vulnerability surface without a version bump (lower-risk than upgrading).
• If a real (perhaps indirect/dynamic) usage is found: convert this to a version-bump task instead and note the discovered usage site.

Notes/Hypotheses (non-binding): These may be leftovers from a prior implementation that was since replaced (e.g. fetch/callApi replacing axios; the hand-rolled src/utils/debounce.ts replacing lodash.debounce, per its own comment) and simply never pruned from package.json. Per AGENTS.md, this routine does not modify dependencies itself; filing for a human/agent session to verify and act.