Audit and reduce dependencies Reduce JavaScript dependency footprint. Use pnpm only . Preserve the lockfile, workspace layout, and dependency range style unless there is a concrete reason to change them. For GitHub Actions workflow triage (action choice, permissions, pinning), use a dedicated workflow audit — not the reporting format below (workflow file + step only when the finding is pnpm install policy ). Workflow 0. Hardening gate: run (read-only). See check-npm. 1. Establish the baseline. 2. Remove unused direct dependencies. 3. Deduplicate direct dependency versions in monorepos. 4. Ran…