npm ci pulls a deprecated PhantomJS binary and can fail CI at random

[killerwolf]

What happened

The main CI run after #31 merged failed — not in lint, typecheck, tests or the build, but at Install dependencies:

npm warn deprecated phantomjs-prebuilt@2.1.16: this package is now deprecated
npm error code 1
npm error path .../node_modules/phantomjs-prebuilt
npm error PhantomJS not found on PATH
npm error Downloading https://github.com/Medium/phantomjs/releases/download/v2.1.1/phantomjs-2.1.1-macosx.zip
npm error Status: 504

Run: https://github.com/killerwolf/QuickToss/actions/runs/34130342904

Why

phantomjs-prebuilt has a postinstall script that downloads a 17 MB binary from GitHub release assets whenever it isn't already cached. It reaches this project through:

electron-icon-builder@2.0.1
└─ icon-gen@2.1.0
   └─ svg2png@4.1.1
      └─ phantomjs-prebuilt@2.1.16   (deprecated)

The asset itself is fine — fetching it now returns 200 and the full 17 MB. The failure was a transient 504 Gateway Timeout from GitHub. That's the whole problem: a clean install depends on a 17 MB download from a third party, so any blip there fails npm ci outright, for CI and for contributors.

Why it's avoidable

electron-icon-builder is used by exactly one thing — npm run build:icons, which regenerates the app icon and is run by hand when the icon changes.

• No workflow runs build:icons (grep build:icons .github/workflows/ → nothing).
• scripts/build-icons.js:19 already invokes it through npx, not through a local import.

So it sits in the install path of every clean install while only being needed for an occasional manual task.

Suggested fix

Drop electron-icon-builder from devDependencies. npx fetches it on demand when icons are actually rebuilt, which takes PhantomJS out of the normal install path entirely.

Two things worth checking before merging that, so the fix isn't naive:

1. npx prompts. With the package absent, npx electron-icon-builder asks "Ok to proceed?" and fails in a non-interactive shell. scripts/build-icons.js:19 should probably use npx --yes.
2. Rebuilding icons still pulls PhantomJS, just only at that moment rather than on every install. That's the point of the change, but it means build:icons keeps the same fragility.

Alternative, if it's worth more effort

Replace electron-icon-builder outright. scripts/build-icons.js already uses sharp to render a 1024×1024 master PNG, and sharp has no such dependency — only the .icns/.ico packing step needs the extra tool. A maintained packer would remove the deprecated chain rather than move it.

Context

This was invisible until recently: release.yml only ran on tags and pull requests, so main never ran CI. It now runs on pushes to main (#30), which is how this surfaced — and it means the CI badge in the README can show a spurious red.