@performant-software/shared-components exports an Analytics component built on react-ga4, and the package.json declares no sideEffects field. Without that flag, bundlers can't tree-shake the barrel (dist/index.es.js), so importing anything from the package pulls in the bundled react-ga4 module — including its runtime gtag injector:
n.src = `https://www.googletagmanager.com/gtag/js?id=${e}`Observed in FairData Sites (core-data-places 3.1.25): the site has no analytics code at all, but a 1.7 MB public _astro chunk contains the GA4 loader on every deployed site. Clients do inspect our shipped bundles (a university infosec team recently reviewed one), and an analytics loader that's never used is exactly the kind of thing that raises questions.
Suggested fix, either or both:
- Add
"sideEffects": false to shared-components' package.json (assuming the modules are side-effect-free — the dist is already built with preserved module structure, so tree-shaking should then drop it).
- Make
react-ga4 a lazy import() inside the Analytics component so only consumers that render it pay for it.
Found by the new dhtools fds inventory bloat census (dhtools#15).
@performant-software/shared-componentsexports anAnalyticscomponent built onreact-ga4, and the package.json declares nosideEffectsfield. Without that flag, bundlers can't tree-shake the barrel (dist/index.es.js), so importing anything from the package pulls in the bundled react-ga4 module — including its runtime gtag injector:Observed in FairData Sites (core-data-places 3.1.25): the site has no analytics code at all, but a 1.7 MB public
_astrochunk contains the GA4 loader on every deployed site. Clients do inspect our shipped bundles (a university infosec team recently reviewed one), and an analytics loader that's never used is exactly the kind of thing that raises questions.Suggested fix, either or both:
"sideEffects": falseto shared-components' package.json (assuming the modules are side-effect-free — the dist is already built with preserved module structure, so tree-shaking should then drop it).react-ga4a lazyimport()inside theAnalyticscomponent so only consumers that render it pay for it.Found by the new
dhtools fds inventorybloat census (dhtools#15).