Remove two unmaintained packages: csp-parse and http-status-code (#63236)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 35abb1df-6285-443c-892a-30c594d2d64c

Author: heiskr

package-lock.json

@@ -295,7 +295,6 @@
     "change-case": "^5.4.4",
     "commander": "^15.0.0",
     "cross-env": "^10.1.0",
-    "csp-parse": "0.0.2",
     "csv-parse": "7.0.0",
     "domhandler": "^5.0.3",
     "escape-string-regexp": "5.0.0",
@@ -317,7 +316,6 @@
     "globals": "^17.3.0",
     "gpt-tokenizer": "^4.0.0",
     "graphql": "^16.12.0",
-    "http-status-code": "^2.1.0",
     "husky": "^9.1.7",
     "is-svg": "6.0.0",
     "jiti": "^2.6.1",

package.json

@@ -1,5 +1,3 @@
-// csp-parse doesn't have TypeScript types
-import CspParse from 'csp-parse'
 import { beforeAll, describe, expect, test, vi } from 'vitest'
 
 import enterpriseServerReleases from '@/versions/lib/enterprise-server-releases'
@@ -17,6 +15,21 @@ interface Category {
   published_articles: string[]
 }
 
+// Parses a Content-Security-Policy header into its directives. Mirrors the
+// behavior of the unmaintained `csp-parse` package it replaces: the policy is
+// lowercased, split on `;`, and each directive's values are returned as a
+// space-joined string, or an empty string when the directive is absent.
+function parseCsp(policy: string) {
+  const directives = new Map<string, string>()
+  for (const part of (policy || '').toLowerCase().split(';')) {
+    const [name, ...values] = part.trim().split(/\s+/)
+    if (name) directives.set(name, values.join(' '))
+  }
+  return {
+    get: (directive: string) => directives.get(directive) || '',
+  }
+}
+
 describe('server', () => {
   vi.setConfig({ testTimeout: 60 * 1000 })
 
@@ -50,7 +63,7 @@ describe('server', () => {
     expect(res.statusCode).toBe(200)
     expect('content-security-policy' in res.headers).toBe(true)
 
-    const csp = new CspParse(res.headers['content-security-policy'])
+    const csp = parseCsp(res.headers['content-security-policy'])
     expect(csp.get('default-src')).toBe("'none'")
 
     expect(csp.get('font-src').includes("'self'")).toBe(true)

src/frame/tests/server.ts

@@ -1,4 +1,5 @@
-import httpStatusCodes from 'http-status-code'
+import { STATUS_CODES } from 'node:http'
+
 import { get, isPlainObject } from 'lodash-es'
 import { parseTemplate } from 'url-template'
 import mergeAllOf from 'json-schema-merge-allof'
@@ -131,7 +132,7 @@ export default class Operation {
         responseKeys.map(async (responseCode) => {
           const response = responses[responseCode]
           const httpStatusCode = responseCode
-          const httpStatusMessage = httpStatusCodes.getMessage(Number(responseCode), 'HTTP/2')
+          const httpStatusMessage = STATUS_CODES[Number(responseCode)] || 'Unknown'
           // The OpenAPI should be updated to provide better descriptions, but
           // until then, we can catch some known generic descriptions and replace
           // them with the default http status message.