chore(deps): remove unused dependencies

[Charles Hudson (phobetron)]

Summary

• Remove eight unused pnpm catalog entries and the inert Vitest override.
• Remove 19 high-confidence unused dependency declarations from the root workspace, shared mocks, published Web and React Native packages, and maintained reference implementations.
• Regenerate the root lockfile, pruning 61 packages that are no longer reachable.
• Retain dependencies with a supported manual or implicit toolchain use, including Rsdoctor, tslib, and Hermes.

Why

These dependencies are not referenced by source, tests, configuration, package scripts, framework conventions, or an established manual workflow. Keeping them makes the declared dependency graph misleading, adds unnecessary install and lockfile surface, and causes Renovate to open or update dependency PRs for packages that have no effect on the repository.

Removing them keeps manifests aligned with actual usage and prevents ongoing Renovate churn for unused dependencies.

Validation

• Dependency installation and supply-chain policy checks for the root workspace and both affected standalone implementations
• Prettier check for all changed manifests and lockfiles
• pnpm lint
• pnpm typecheck
• Mocks typecheck
• Web SDK typecheck, build, and 317 unit tests
• React Native SDK typecheck, build, and 108 unit tests
• React Native package dev Jest command, which completed with no tests found
• Node + Web implementation typecheck and unit test
• React Native implementation lint and typecheck
• git diff --check

Validation note

The React Native implementation generic Jest command was also attempted, but its existing Jest 29 configuration fails before executing assertions because it cannot parse the React Native 0.84 ESM setup file. The failure does not report a missing removed dependency; implementation lint and typecheck pass.

[bito-code-review]

Code Review Agent Run #1e4c17

Actionable Suggestions - 0

Review Details

• Files reviewed - 7 · Commit Range: 17c0cd4..17c0cd4

  • implementations/node-sdk+web-sdk/package.json
  • implementations/react-native-sdk/package.json
  • lib/mocks/package.json
  • package.json
  • packages/react-native-sdk/package.json
  • packages/web/web-sdk/package.json
  • pnpm-workspace.yaml
• Files skipped - 1

  • pnpm-lock.yaml - Reason: Filter setting
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers an incremental AI Review.

• /review full - Manually triggers a full AI Review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at jared.jolton@contentful.com.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[bito-code-review]

Impact Analysis by Bito

Cross-Repository Impact Analysis

What Changed	Impact of Change	Suggested Review Actions
Removed direct development and test dependencies across SDK implementations and shared packages.	- verify-needed: @contentful/optimization-core, @types/express, @commitlint/prompt-cli, @types/qs, @types/supertest: These dependencies may be referenced by package scripts, source files, or consumers; cross-repository usage was not verified. - verify-needed: core-js, dotenv, @babel/plugin-transform-class-properties, @babel/plugin-transform-private-methods, @react-native/typescript-config: React Native build, Babel, runtime-polyfill, or configuration behavior may rely on these packages even though they are development dependencies in the manifests.	- Run pnpm install --lockfile-only and pnpm install --frozen-lockfile to verify importer and package snapshots remain consistent. - Search each removed package name in scripts, configuration, source, and CI files before merge. - Build and test both implementations/react-native-sdk and packages/react-native-sdk on a clean checkout.
Removed workspace catalog entries and the vitest override.	- verify-needed: workspace packages consuming catalog entries for vitest, @vitest/coverage-v8, browserslist, qs, supertest, dotenv, @types/qs, and @types/supertest: Removing catalog entries can make existing catalog references unresolved or alter dependency resolution in workspace packages.	- Enumerate all workspace package.json files using catalog: for each removed catalog key. - Run pnpm -r install --frozen-lockfile and pnpm -r test. - Confirm the intended test runner remains available for every package after removing vitest and @vitest/coverage-v8.
pnpm-lock.yaml removes the corresponding importer entries and a large set of Jest 30, Babel, resolver, and related transitive snapshots.	- verify-needed: all workspace importers changed in pnpm-lock.yaml: The lockfile cleanup may be valid dependency garbage collection, but stale importer references or platform-specific optional dependency omissions could break clean installs.	- Regenerate the lockfile with the repository's pinned pnpm version and confirm the diff is reproducible. - Test frozen installs on Linux and at least one macOS or Windows environment because optional resolver bindings were removed. - Check that remaining Jest 29, React Native, Playwright, and Rstest dependency graphs contain no missing peer or optional dependencies.

Code Paths Analyzed

Impact:
This change is dependency and lockfile cleanup only. It removes unused or allegedly unused package declarations from multiple SDK implementations, shared libraries, workspace catalogs, and the pnpm lockfile. No application source, public HTTP API, data schema, or runtime configuration endpoint is modified directly.

Flow:
Workspace manifests and catalogs → pnpm importer resolution → lockfile package and snapshot graph → clean install → SDK build, Babel/Metro transformation, Jest/Rstest/Playwright execution, and package scripts.

Direct Changes (Diff Files):
• implementations/node-sdk+web-sdk/package.json [3-14] — Removes @contentful/optimization-core from devDependencies.
• implementations/react-native-sdk/package.json [16-53] — Removes core-js, Babel transform plugins, React Native TypeScript config, dotenv, and jest-circus.
• lib/mocks/package.json [56-66] — Removes @types/express.
• package.json [69-80] — Removes @commitlint/prompt-cli.
• packages/react-native-sdk/package.json [82-121] — Removes React Native Babel, Jest, testing-library, type, polyfill, dotenv, and jest-circus dependencies.
• packages/web/web-sdk/package.json [123-132] — Removes tsx from devDependencies.
• pnpm-lock.yaml [136-1902] — Updates catalogs, importers, package resolutions, and snapshots to remove the deleted dependency graph.
• pnpm-workspace.yaml [1905-1942] — Removes catalog entries for testing, HTTP, browser, query-string, and dotenv dependencies and removes the vitest override.
• agent-session-1e4c171f-49ff-4408-a87c-2c9399f7312f-0-multi_level_pr_summary_generation [new file] — Untracked session artifact present in the cloned working tree; it is not represented in the supplied diff and should not be committed.

Repository Impact:
• React Native SDK build pipeline: Babel, Metro, Jest, TypeScript configuration, polyfill, and test-library dependencies are removed from both implementation and package manifests.
• Workspace test tooling: Vitest and coverage catalog entries plus the vitest override are removed, while Jest 29 and Rstest remain in parts of the workspace.
• Package-manager installation graph: The lockfile removes many versioned snapshots, including Jest 30, resolver bindings, and optional platform packages.
• Developer and CI scripts: Removing tsx, commitlint prompt CLI, dotenv, supertest, or testing packages can break scripts that invoke them directly.

Cross-Repository Dependencies:
• Potential consumers of the optimization workspace and published SDK packages: The dependency graph tool could not resolve repository name optimization, so incoming and outgoing repository consumers could not be confirmed.

Database/Caching Impact:
• None

API Contract Violations:
• No HTTP, gRPC, GraphQL, event, database, or exported source-code API contract changes are visible in the supplied diff.
• The effective package-manager contract may change if any workspace script or build configuration assumes a removed dependency is available transitively.

Infrastructure Dependencies:
• CI must use a pnpm version compatible with the regenerated pnpm-lock.yaml.
• Frozen-lockfile installs must be validated across supported operating systems because optional native resolver packages were removed.
• React Native and Metro build environments must be checked for required Babel presets, TypeScript configuration, and polyfills after dependency removal.
• The untracked session artifact should be excluded from the commit and CI context.

Additional Insights:
• Reproducibility: The extensive lockfile cleanup should be reproducible from the edited manifests; otherwise the lockfile may contain accidental or stale removals.
• Testing confidence: Removing test-only packages can make tests fail before execution rather than producing application-level failures, so clean-install validation is essential.

Testing Recommendations

Frontend Impact:
• Build the web SDK packages after the tsx removal and verify every package script that invokes tsx still has an explicit replacement or no longer needs it.
• Build the React Native implementation and package on a clean install using Metro/Babel, including class fields, private methods, decorators, and static-block syntax used by the SDK.

Service Integration:
• Run pnpm -r install --frozen-lockfile followed by the repository's recursive build, lint, and test commands.
• Run React Native unit tests and Detox smoke tests to verify removal of jest-circus, @testing-library/react-native, and related Jest 30 snapshots does not affect test discovery or execution.

Data Serialization:
• No serialization or schema changes are present; retain existing SDK serialization tests as a regression check after the dependency graph changes.

Privacy Compliance:
• No privacy-sensitive runtime behavior is changed; verify that removing dotenv does not cause test fixtures or CI secrets to be loaded through an unintended fallback.

Backward Compatibility:
• Verify all workspace package manifests resolve without relying on removed catalog entries.
• Check scripts and configuration for direct references to every removed dependency, especially @contentful/optimization-core, dotenv, tsx, vitest, supertest, @testing-library/react-native, and @react-native/typescript-config.
• Run package-level tests for consumers of the React Native SDK to ensure published package installation does not depend on removed devDependencies.

OAuth Functionality:
• None

Cross-Service Communication:
• No service-to-service contract is changed. Validate package installation in the same CI jobs that build and publish the SDKs to catch dependency-resolution failures before publication.

Reliability Testing:
• None

Additional Insights:
• Regenerate pnpm-lock.yaml with the pinned pnpm version and verify there are no unexpected changes beyond the intended removals.
• Run frozen installs on Linux and at least one macOS or Windows runner to validate removal of UnRS (@unrs) resolver bindings and other optional platform packages.
• Confirm the intended test runners remain available: Jest 29, Rstest, Playwright, or another explicitly declared runner for each workspace package.
• Remove the untracked session artifact agent-session-1e4c171f-49ff-4408-a87c-2c9399f7312f-0-multi_level_pr_summary_generation before committing.

_{Analysis based on known dependency patterns and edges. Actual impact may vary.}

[bito-code-review]

✅ Review Settings Overridden

Status: Overridden Successfully

Guidelines:

• Accepted:

  • General : Review Posture, Repo Truth And Boundaries, Domain Invariants

  • Language : typescript= TypeScript Review Evidence

Note: Extra guidelines beyond 3 general purpose guidelines and 1 language specific guideline per language are not processed. Guidelines are fetched from the source branch.

[Felipe Mamud (fmamud)]

🔪

[bito-code-review]

Bito Automatic Review Skipped – PR Already Merged

Bito scheduled an automatic review for this pull request, but the review was skipped because this PR was merged before the review could be run.
No action is needed if you didn't intend to review it. To get a review, you can type /review in a comment and save it