chore(examples): drop the dead @handsontable/pikaday dependency (DEV-2733)

[demtario]

DEV-2733

What is dead

examples/javascript/package.json declared "@handsontable/pikaday": "latest" and nothing in the repo imported it. Handsontable 18.0.0 removed pikaday (handsontable#12689) and the date editor now builds a native input[type=date], so the dependency has been inert since the 18 line. It was redundant even before that — handsontable@15/16/17 each depend on @handsontable/pikaday: ^1.0.0 transitively, so the starter never needed to name it.

Also empties examples/angular's allowedCommonJsDependencies. All three entries were HT<18 transitive deps: handsontable@18 has zero dependencies, and neither numbro nor bare core-js appears anywhere in that starter's lockfile (only core-js-compat, a build-time devkit dep that is never bundled).

NEVER_REWRITE stays — and its docstring was the real bug

Scope item 3 asked whether the exemption could go. It cannot, and the ticket's grep (scoped to examples/) missed why. The exemption lives in two deliberately mirrored places — runner/packages/runtime/src/version.ts:39 and runner/pipeline/import.mjs:137, the latter kept dependency-free on purpose.

Only 1.0.0 of the fork was ever published. pinHandsontableDependencies feeds defaultRegenLockfile, which runs a real pnpm resolve, so dropping the exemption would not mis-pin — it would fail bucket 15–18 imports outright with ERR_PNPM_NO_MATCHING_VERSION. All four prod-examples/15|16|17|18 branches still declare the fork, so it stays load-bearing for them.

The docstring gave the removal condition as "no bucket under apps/authoring/public/docs-examples/ imports the fork" — already satisfied since DEV-2182 (zero hits there today), while starter-examples/ still carries it in 52 files. A reader following that comment would have deleted a still-needed exemption. Repointed at the starter buckets and the frozen branches, and recorded that the predicate also gates handsontableDependencyRef, not just the rewrite.

Keeping the exemption tested

import.test.mjs reached the pipeline-side exemption only through artifacts generated from the working tree, so removing the dependency makes its !== "@handsontable/pikaday" guard vacuous — the test would keep passing while exercising nothing. Added a synthetic pinHandsontableDependencies test, mirroring the runtime's own guard in ht-version-resolve.test.mjs:140.

Verified it is a real guard: with the exemption temporarily emptied, the new test fails (actual: '15.3.0') while every other test in that file still passes — which is exactly the vacuity it was added to cover.

Verification

• grep -c pikaday examples/javascript/pnpm-lock.yaml → 0. Lock diff is exactly the three expected blocks (importer, packages:, snapshots:); handsontable unmoved at 18.1.0.
• examples/javascript: pnpm install --frozen-lockfile and pnpm build both clean.
• examples/angular: build output byte-identical before vs. after apart from the timestamp, and neither build emitted a CommonJS warning.
• runner: pnpm test → 949 tests, 0 fail (2 pre-existing todos). pnpm typecheck → 0 errors.
• Version downgrade is unaffected: resolveStarterBucket + loadStarterExample fetch the target bucket's own artifact, so a clean switch to 15 loads prod-examples/15's snapshot, not a re-pinned next one. Only the dirty-crossing path reaches master content at an old major, and it already warns about that. example1 at ?example=example1&v=15.3.0 boots clean regardless — registerAllModules() pulls the date editor, and hence the fork, at bundle time.

Regeneration

Nothing regenerated here. import-starters.yml has no pull_request trigger, and no test compares examples/ on disk to the committed bucket artifacts. On merge, the next bucket regenerates through the usual chore/starter-example-buckets PR — expected diff there is next/javascript.json and next/angular.json and nothing else; a diff in buckets 15–18 would mean something sourced master that should not have.

No scripts/prepare-container.mjs run and no container reseed: javascript is engine: sandpack with no baked context at all, and angular's sourceDependencyFingerprint is hashed over package.json + pnpm-lock.yaml only — neither of which changes here.

The frozen branches keep both the dependency and the allowlist line, per runner/docs/backport-policy.md: cosmetic cleanups are not backport-eligible.

🤖 Generated with Claude Code

---

Note

Low Risk
Example and lockfile cleanup plus documentation and test coverage; runner pinning behavior is unchanged except for clarified comments and an added regression test.

Overview
Removes the unused @handsontable/pikaday dependency from the JavaScript Vite starter and updates its lockfile. The Angular starter’s allowedCommonJsDependencies list is cleared because those entries were only needed for HT<18 transitive CommonJS deps that no longer apply.

The runner keeps the @handsontable/pikaday NEVER_REWRITE exemption (runtime + import pipeline): frozen prod-examples buckets 15–18 still declare the fork, and pinning it to a Handsontable major would break lockfile regeneration. Comments are corrected so removal is gated on starter-examples / frozen branches, not docs-examples.

A synthetic pinHandsontableDependencies test is added so the pikaday exemption stays covered after master’s examples/javascript no longer includes the package (the existing artifact loop would not hit it).

^{Reviewed by Cursor Bugbot for commit 7670ae4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[qunabu]

Task linked: DEV-2733 Remove the dead @handsontable/pikaday dependency from the javascript starter
Task linked: DEV-2182 Runner: swap @handsontable/pikaday for upstream pikaday in the demos.handsontable.com examples repo