Dependency audit follow-ups — 2026-06

This note records the follow-up decisions for Renovate Dependency Dashboard items split into issues #175-#180.

#175 — npm mcp

Decision: no repository change required.

The deprecated npm package named mcp is not declared by this repository. The production MCP server uses the Python mcp[cli] package in pyproject.toml; the root package.json only contains JavaScript development tooling. Treat the dashboard warning as a package-name collision unless a future lockfile or manifest introduces the npm package explicitly.

#176 — husky

Decision: removed.

The repository had no .husky/ directory and no prepare script, so the root husky dev dependency was unused. Git-hook behavior remains covered by the explicit hooks:* package scripts and CI checks.

#177 — Python docker

Decision: removed from the freerouting extra.

The FreeRouting integration invokes the Docker CLI through subprocess and falls back to a configured FreeRouting JAR. It does not import or use the Docker SDK for Python, so keeping docker in the optional extra only expanded the dependency graph without enabling functionality. The freerouting extra is retained as an empty compatibility extra because Dockerfile and user workflows may still request it.

#178 — mkdocs-minify-plugin

Decision: removed.

Docs builds do not require minification for correctness. Removing the plugin avoids an inactive dependency while keeping Material for MkDocs, redirects, glightbox, and mkdocstrings intact.

#179 — pystray

Decision: retained as an isolated optional extra.

The tray integration imports pystray lazily, has tests for the missing-dependency path, and is only installed through kicad-mcp-pro[tray]. There is no runtime dependency for default installs. Revisit if a maintained, cross-platform tray replacement becomes available.

#180 — radon

Decision: removed.

The only repository reference was an unused helper script. There was no package script, workflow, or test invoking it, so the dependency and helper script were removed.