Drop dependencies replaceable by Node built-ins (−23 MB, −16 packages)

[l2ysho]

Measured: installing the full dep tree vs the tree without the deps below = 109 MB → 86 MB (−23 MB, −21%) and 328 → 312 packages. Every npx apify-cli and CI job downloads this fresh.

Droppable now — native replacement on Node 20+

Dep	Usage	Replace with
axios	2 files	native fetch
es-toolkit	only cloneDeep, 9 call sites	structuredClone() — 17 MB for one function
rimraf	1 wrapper (rimrafPromised)	fs.rm(p, { recursive: true, force: true }) (~5 MB incl. glob/lru-cache chain)
strip-ansi	1 file	util.stripVTControlCharacters()
is-ci	1 file	ci-info.isCI — already a dependency; is-ci is that one-liner republished
@root/walk	1 file (scrapy wrapper)	fs.readdir(dir, { recursive: true })
computer-name	1 file (login device label)	os.hostname() — also kills an unmaintained native addon
cors	login's localhost auth server	~3 lines of headers on the existing express handler

Duplicates — consolidate

• adm-zip + archiver are imported in the same file (src/lib/utils.ts) — two full zip implementations; either covers read + write.
• js-levenshtein + @skyra/jaro-winkler both power the same "did you mean" check in useCommandSuggestions.ts (levenshtein <= 2 || jaroWinkler >= 0.975). One metric is plenty — or inline a 20-line levenshtein and drop both.

Blocked on raising the Node floor

• escape-string-regexp (2 files) → RegExp.escape() needs Node 24; a one-liner worth inlining meanwhile.
• tinyglobby (1 file) → fs.glob stable in Node 24.
• chalk (46 files) → util.styleText on 22+; big mechanical diff, zero user-visible gain — last.

Keepers

semver, ajv, handlebars, express, open, mime, giget, execa, inquirer/apify packages. which is borderline but earns its keep on Windows PATHEXT handling.

Suggested order

1. Bump engines to >=22 (Node 20 is EOL since 2026-04).
2. One mechanical PR per dep — all but chalk are single-import.

~10 deps removable today, 23 MB off every install, and ~16 fewer packages to audit next time something like the figlet incident happens.

[l2ysho]

This is just quick summary made by claude while exploring what is doable, feel free to open discussion in any part of it.

[vladfrangu]

For chalk -> look into kleur (easier migration)
computer-name -> os.hostname() needs tests for windows 🫡
js-levenshtein + @skyra/jaro-winkler -> I mostly added both bc they handle similarities differently. Check size and lets keep whichever is smaller and enough

I would also consider express -> fastify or similar, see whats smaller. that said, once oauth2 login works we can outright DROP IT yippee

[l2ysho]

I would also consider express -> fastify or similar, see whats smaller. that said, once oauth2 login works we can outright DROP IT yippee

actually, there is not so much express used (like router with 3 routes and .json()), I would consider node:http (~550kb express vs ~450kb fastify is not a big win) 🤔 or some micro framework as h3 or itty-router