Hi Justinosa,
Thank you for reaching out and for your detailed inquiry.
You are correct in your assumption that ejs and loader-utils are not needed at runtime for the CookieYes plugin. These dependencies are indeed related to the development and build process rather than the functionality of the plugin in a live environment.
loader-utils is used by build tools such as webpack and babel, which are part of the development pipeline to bundle and process code. It’s not required when the plugin is running on your site.ejs is pulled in by the webpack-bundle-analyzer for generating reports during the build process. It’s also not needed in production.
Since these dependencies are part of the build tools and not the actual runtime code, they should not be shipped with the production version of the plugin, assuming the build process is correctly configured. If they are flagged by Dependabot, it’s likely because they are part of the development dependencies and not relevant for production use.
Please let me know if you need further clarification or help with this!
@cookieyesteam — Awesome. Thanks so much!
