slidev - Moses Yebei

The Problem Developers need a fast, Markdown‑driven way to author interactive slide decks that can embed live Vue components, LaTeX, Mermaid diagrams and custom Vite plugins. Maintaining such a tool requires a tight integration between a Vite‑powered dev server, a Vue runtime, and a set of CLI utilities for building and publishing.

What This Does The repository is a portfolio of four self‑contained projects: the core Slidev packages (packages/), a set of runnable demos (demo/), Cypress end‑to‑end tests (cypress/), and assorted helper scripts (scripts/). The core lives in packages/, where packages/client/main.ts boots a Vue app that renders the slide editor and presenter UI. The demo demo/composable-vue/index.html shows how a user can import a Vue component (demo/composable-vue/components/Connections.vue) directly into a slide. Documentation is served from docs/.vitepress/theme/index.ts, which re‑exports the same client UI for the site.

How It Is Wired Execution starts at packages/client/main.ts. It creates the Vue app, registers global utilities from packages/client/composables/useNav.ts (navigation logic) and injects the resolver packages/slidev/node/resolver.ts. The resolver is the hub that maps slide‑relative imports to real files; 17 other modules depend on it, giving it the highest fan‑in. The navigation composable imports packages/client/state/index.ts, which in turn pulls packages/types/src/index.ts for type definitions, forming a circular import chain (useNav → state/index → types/index → back to useNav). The CLI entry packages/client/index.ts ultimately calls packages/slidev/node/vite/index.ts, which configures Vite with plugins from packages/slidev/node/syntax/transform/index.ts. That transformer parses the Slidev‑specific Markdown syntax and injects Vue components. The most unstable module is packages/slidev/node/syntax/transform/index.ts (instability 0.83) because it imports many helper utilities. Because of these cycles and hub modules, a change in navigation or resolver logic can ripple through many files (up to 17 dependents), raising the risk of regression.

How To Use It

# clone the repo
git clone https://github.com/moses-y/slidev
cd slidev

# install all workspace packages (pnpm is the lockfile manager)
pnpm install

# run the documentation site (Vite dev server)
pnpm dev   # defined in the root package.json scripts

The demo/composable-vue demo can be opened directly in a browser via its index.html. No additional environment variables are required; configuration lives in the various vite.config.ts files under demo/ and cypress/fixtures/basic/.

Real‑World Use A tech‑blog author can write a slide deck in slides.md (e.g., cypress/fixtures/basic/slides.md), embed a live Vue component with <Component src="./components/Counter.vue" />, run pnpm dev to preview changes instantly, then pnpm build (CLI defined in packages/client/index.ts) to export a PDF or PPTX for distribution. The same workflow integrates with the VSCode extension (assets/logo-for-vscode.png) for in‑IDE editing.

Code Health & Issues

High – Import cycles (24 modules). Example: packages/client/composables/useNav.ts, packages/vscode/src/projects.ts, packages/client/state/index.ts. Break cycles by extracting shared types or deferring imports.
Medium – High branching density in packages/slidev/node/resolver.ts, packages/slidev/node/syntax/transform/utils.ts, packages/vscode/src/composables/useFocusedSlide.ts. Refactor into strategy objects or tables.
Medium – Hub modules (resolver.ts, useNav.ts, env.ts) have large fan‑in; keep them stable and small.
High – Repeated 6‑line code blocks across demo and docs components. Consolidate into shared helpers.
Medium – Oversized files: packages/client/.generated/unocss-tokens.ts and packages/slidev/node/cli.ts. Split by responsibility.
Low – Three TODO/FIXME markers in packages/vscode/src/views/slidesTree.ts. Create issues or resolve them.

Health audit findings (static analysis):

High – GitHub Actions pinned to tags only; replace with commit SHAs.
Medium – GITHUB_TOKEN permissions not declared; add permissions: { contents: read }.
Medium – No Dependabot/Renovate; add .github/dependabot.yml.
Medium – No dependency‑vulnerability scan in CI; add dependency-review-action or osv-scanner.
Medium – Checkout step keeps credentials; set persist-credentials: false.
Medium – Test coverage low (9 test files vs 352 source files); add tests for high‑fan‑in modules.
Low – Job timeouts missing; set timeout-minutes.
Low – Missing editor/formatter conventions; add .editorconfig, .gitattributes, formatter config.

The Bottom Line Slidev provides a well‑structured, Vite‑powered slide authoring stack with rich Vue integration, but its core suffers from import cycles and several high‑impact hub modules that increase change risk. The repo is healthy in terms of CI and licensing, yet it needs tighter CI security, broader test coverage, and refactoring of duplicated or oversized code before being used as a production‑grade foundation. Engineers comfortable with Vue, Vite, and TypeScript will find it a solid starting point, provided they address the highlighted cycles and health gaps.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

699 files

TypeScript242
Markdown175
Vue144
JSON33
CSS12
YAML10

ReactVueTransformers

Architecture

Top-level areas of the codebase, sized by module count. Arrows show how many imports cross from one area into another.

graph TD g0["packages 211 modules"] g1["docs 14 modules"] g2["test 6 modules"] g3["(root) 6 modules"] g4["scripts 6 modules"] g5["demo 5 modules"] g6["cypress 2 modules"] g2 -->|13| g0 g0 -->|3| g3

Module dependencies

The 10 most depended-upon modules of 250, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_ackages_slidev_node_resolver["resolver"] n1_es_client_composables_useNav["useNav"] n2_packages_vscode_src_projects["projects"] n3_packages_client_env["env"] n4_packages_client_state_index["index"] n5_es_slidev_node_virtual_types["types"] n6_packages_slidev_node_utils["utils"] n7_packages_client_constants["constants"] n8_packages_client_logic_slides["slides"] n9_packages_client_logic_dark["dark"] n1_es_client_composables_useNav --> n7_packages_client_constants n1_es_client_composables_useNav --> n3_packages_client_env n1_es_client_composables_useNav --> n8_packages_client_logic_slides n1_es_client_composables_useNav --> n4_packages_client_state_index n9_packages_client_logic_dark --> n3_packages_client_env n8_packages_client_logic_slides --> n1_es_client_composables_useNav classDef cyc stroke:#ef4444,stroke-width:2px; class n1_es_client_composables_useNav,n2_packages_vscode_src_projects,n4_packages_client_state_index,n7_packages_client_constants,n8_packages_client_logic_slides cyc;

Dependencies

8 declared dependencies, none a major version behind. Resolved 8 of 8 against the registry.

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high1

medium5

low2

Pin third-party GitHub Actions to a commit SHAhigh2 occurrences

.github/workflows

pnpm/action-setup@v4, cypress-io/github-action@v7

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Declare least-privilege permissions for GITHUB_TOKENmedium2 occurrences

.github/workflows/smoke.yml

2 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

14 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Set persist-credentials: false on checkoutmedium

.github/workflows/release.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Expand the test suite; it cannot cover this codebasemedium9 occurrences

9 test files against 352 source files (ratio 0.026)

A reviewer reads "has tests" and assumes a safety net that covers two files out of eighty-five, which is how untested paths ship behind a green badge.

Fix: Add tests for the highest fan-in modules first.

Set timeout-minutes on the workflow jobslow

.github/workflows/release.yml

1 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.