perf: lazily resolve install size and vulns

[serhalp]

🔗 Linked issue

N/A

🧭 Context

Both of these operations are intensive and scale with package size and/or number of transitive dependencies. Neither should really block the page load. Both should be cached at a fine grain.

📚 Description

In the worst case scenario in my testing, this cut 55% of the cold render TTFB for the package page:

pkg	before (main)	after (branch)	Δ
nitropack (273 deps)	3.89 s	1.74 s	−2.15 s (−55%)
next	3.84 s	2.81 s	−1.03 s
vite	3.45 s	3.07 s	−0.37 s
tinyglobby (2 deps)	1.52 s	1.42 s	−0.11 s

The SSR response also gets significantly smaller in the worst case (e.g. nitropack's _payload.json goes from 54.6 KB to 11.9 KB, −78%), but of course this size is just shifted to a different downstream request. (However, this latter cost isn't paid when the page is loaded by a crawler that doesn't execute JS 👀.)

or, more directly measuring the work that should be removed from the SSR hot path:

pkg	install-size	vulnerabilities
nitropack	1.42 s	1.07 s
next	1.40 s	0.59 s
vite	2.38 s	0.45 s
tinyglobby	0.04 s	0.16 s

(These operations run concurrently, so don't try to add them up.)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
npmx.dev	Ready	Preview	Oct 11, 2026 2:55am UTC

2 Skipped Deployments

Project	Deployment	Actions	Updated
docs.npmx.dev	Ignored		Oct 11, 2026 2:55am UTC
npmx-lunaria	Ignored		Oct 11, 2026 2:55am UTC

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: npmx-dev/npmx.dev/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 45831b05-af6c-43ee-a7e7-5ca1e07b3833

---

📥 Commits

Reviewing files that changed from the base of the PR and between 9ab02a3 and 129b826.

---

📒 Files selected for processing (3)

• app/components/DepsStats/DependencyStatsPanel.vue
• app/composables/useDependencyAnalysis.ts
• app/pages/package/[[org]]/[name].vue

---

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

---

📝 Summary

Summary by CodeRabbit

• Performance
  • Dependency analysis now loads lazily in the browser, reducing work during initial page rendering.
  • Install-size information is fetched in the browser rather than during server-side rendering.
• Bug Fixes
  • Install-size details continue to show their existing pending, available, comparison and unavailable states when displayed.

Walkthrough

Dependency analysis and install-size fetching now run on the client. The package page displays total install size inside ClientOnly, while keeping its existing comparison and display states.

Changes

Client-side fetching

Layer / File(s)	Summary
Dependency analysis request app/composables/useDependencyAnalysis.ts	useFetch now uses server: false and lazy: true. The documentation describes the analysis work, its consumers and URL-based request deduplication.
Install-size fetching and display app/components/DepsStats/DependencyStatsPanel.vue, app/pages/package/[[org]]/[name].vue	The install-size watchers now run only on the client. The package page renders the total install-size display inside ClientOnly; its comparison and pending, value and unavailable states are unchanged.

Suggested reviewers: alexdln

---

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 129b8

The page can render its initial placeholders and load analysis and install-size content in the browser; no material merge-blocking regression is established.

Pre-merge checks | 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check		The title clearly summarises the main performance change: lazy resolution of install size and vulnerabilities.
Description check		The description directly explains the performance objective, affected operations, caching intent, and measured results.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 25.00000% with 6 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
app/pages/package/[[org]]/[name].vue	0.00%	3 Missing and 2 partials ⚠️
app/components/DepsStats/DependencyStatsPanel.vue	66.66%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!