Not entirely related to your question, but seems like you're shipping a development build to your client. I would try shipping a release one instead.

don't think it's a dev build, I'm just checking, it might have some dev dependencies though, but the first file flagged looks like the actual runtime so not removable

do you think it's a dev build because it has shadow.js?

Because of cljs-runtime.

A prod build should have as many JS files as it has modules. In most cases, just one.

oh I stand corrected

is that dependent on build tool? webpack et at bundle into a single file right but shadow-cljs release I didn't know bundled by default

reading, it definitely bundles to the browser but doesn't specify for node-library target

Ah, no clue about libraries. You might want to ask in #C6N245JGG.

I think you're right, even with node-lib I think it's targetting a single file, i just also have some cruft from development in there

thanks @U2FRKM4TW

lol wtf is this 😛

the ethe entire cljs-runtime dir is purely for dev builds. not related to release builds and should be deleted before shipping

still not a clue what would make it flag as trojan 😛

maybe because it uses eval?

I should have wiped my public folder between builds lol

Sorry all

Moving the with-redefs inside of the test's go block seems to work 👍