chore: remove the dead charts-gen tool (2 criticals)

[bsod90]

Deletes packages/cubejs-playground/charts-gen — 19 files, 2164 deletions, of which
1129 are its own stale yarn.lock. That lockfile is the only thing keeping two criticals
open:

alert	package	patched?
#8233	decompress <= 4.2.1	no patch exists
#7227	@babel/traverse < 7.23.2	7.23.2

Both close outright, because the vulnerabilities live only in a lockfile nothing resolves.

Why this is dead code, not merely quiet

I checked four independent things rather than relying on "looks unused":

1. Nothing references it. No hit for charts-gen anywhere outside the directory — not in source, not in .github/**. The only package.json match is its own "name" field.
2. It is not a workspace member. Root workspaces are rust/* and packages/*. This sits one level deeper (packages/cubejs-playground/charts-gen), so it falls outside the glob and its lockfile is never installed by a normal build — which is also why it has been quietly accumulating advisories.
3. cubejs-playground never invokes it. None of its scripts — build, build:lib, build:vizard, build:playground, dev, serve, watch, unit — mention charts or chunks.
4. It cannot run as checked in. Its README instructs you to hand-create a symlink into node_modules/.tmp pointing at a separate repo, cube-js/cube-playground-templates — last pushed 2022-12-06.

Creating a symlink for chart renderers generation
ln -s [PATH]/cubejs-playground-templates [PATH]/charts-gen/node_modules/.tmp/cubejs-playground-templates

So even a developer who wanted to use it would need a 3.5-year-stale sibling checkout and a manual symlink.

Same shape as the earlier packages/load-test removal.

Verification

• git grep charts-gen after the deletion returns nothing outside the root yarn.lock
• No build, lint, or CI config referenced it, so there is nothing to update alongside

If chart-renderer generation is ever wanted again, it should return as a real workspace on
a current toolchain rather than a resurrected 2022 tree.

🤖 Generated with Claude Code

[claude]

Claude finished @bsod90's task in 1m 25s —— View job

---

Review: approve — deletion is safe. 0 blocking, 1 note worth recording

Full review — verification of each claim, plus one caveat about chart-renderers

• Gather context (diff, deleted file contents)
• Verify claim 1: nothing references charts-gen
• Verify claim 2: not a workspace member
• Verify claim 3: cubejs-playground scripts never invoke it
• Verify claim 4: cannot run as checked in
• Check downstream consumers of its output artifacts
• Post review

Claim-by-claim verification

Claim	Result
No references outside the directory	✅ git grep -l charts-gen returns nothing repo-wide after deletion
Not a workspace member	✅ root workspaces.packages = ["rust/*", "packages/*"]; the dir sits at packages/cubejs-playground/charts-gen, one level too deep — its yarn.lock is never resolved
Playground scripts don't invoke it	✅ unit, dev, serve, watch, build:lib, build:vizard, build, build:playground — none touch charts or chunks
Cannot run as checked in	✅ env.js points at cube-js/cubejs-playground-templates and the README requires a hand-made symlink into node_modules/.tmp

The security argument holds: both advisories are anchored in a lockfile that no install path resolves, so deleting the file closes them outright rather than masking them.

One caveat the description doesn't mention (not blocking)

The tool's output still has a live consumer. react/build.sh etc. wrote into ../public/chart-renderers/<framework>/, and that path is loaded at runtime:

packages/cubejs-playground/src/components/ChartRenderer/ChartRenderer.tsx:248

src={`/chart-renderers/${framework}/index.html#queryId=${queryId}`}

So this PR removes the only (already-broken) mechanism for regenerating those assets. It doesn't change behavior today, because:

• public/chart-renderers is not committed (git ls-files → 0 matches) and isn't in .gitignore — only /charts-dist is;
• packages/cubejs-playground/README.md:51-52 tells developers to copy the directory out of node_modules/@cubejs-client/playground/public/chart-renderers, i.e. from a previously published tarball;
• the matching e2e spec packages/cubejs-testing/cypress/e2e/chart-renderers.spec.js is describe.skip(...) with an empty chartTypeByQuery array, so nothing exercises it in CI either.

In other words the regeneration path was already dead by the time of this PR — the assets are inherited from an old publish. Worth being explicit about in the PR body so the next person who needs to rebuild a chart renderer knows the recipe left with this commit, and that it would have to be rebuilt from scratch on a current toolchain (as the description already concludes).

Other review dimensions

Nothing to review for error handling, input sanitization, performance, or API docs — the change is pure deletion of unreferenced code. No tests to add; no build/lint/CI config referenced the directory, so there is correctly nothing to update alongside. Commit message follows the repo's conventional-commit convention.

· branch `maxim/oss-drop-charts-gen`