From a1ad76e19153998751ebab930b046fa4e53d391a Mon Sep 17 00:00:00 2001
From: SatoshiQaziMuhammed <info@pezkuwichain.io>
Date: Mon, 26 Oct 2026 17:45:44 +0400
Subject: [PATCH] web: drop zod and @hookform/resolvers, which nothing imports;
 vite 7.3.7 (#63)

Neither package is imported anywhere in web/ or shared/. They reached the
production bundle only because vite.config.ts named them in the "forms"
manual chunk, which forces a module into the build whether or not any
code uses it. #61 moved zod to 4.6.7 to clear the advisory; removing it
takes the package out of the shipped bundle altogether (abitype declares
it as an optional peer, so nothing installs it). The "forms" chunk now
holds react-hook-form alone.

vite 7.3.7 (2026-10-06) closes the launch-editor advisories on 7.0.0-7.3.6
(Dependabot #313-#315). They reach only the dev server, but the alerts
are real. Typecheck ratchet 335/335, 32 tests, build green.
---
 web/package-lock.json | 30 +++++-------------------------
 web/package.json      |  6 ++----
 web/vite.config.ts    |  2 +-
 3 files changed, 8 insertions(+), 30 deletions(-)

diff --git a/web/package-lock.json b/web/package-lock.json
index 5ebeb0f5..935402d7 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -8,7 +8,6 @@
       "name": "vite_react_shadcn_ts",
       "version": "1.0.0",
       "dependencies": {
-        "@hookform/resolvers": "^3.9.0",
         "@noble/ciphers": "^2.1.1",
         "@noble/curves": "^2.0.1",
         "@noble/hashes": "^2.0.1",
@@ -77,8 +76,7 @@
         "sonner": "^1.5.0",
         "tailwind-merge": "^2.5.2",
         "uuid": "^11.1.0",
-        "vaul": "^0.9.3",
-        "zod": "^4.6.7"
+        "vaul": "^0.9.3"
       },
       "devDependencies": {
         "@eslint/js": "^9.9.0",
@@ -107,7 +105,7 @@
         "tailwindcss-animate": "^1.0.7",
         "typescript": "^5.5.3",
         "typescript-eslint": "^8.0.1",
-        "vite": "^7.3.1",
+        "vite": "^7.3.7",
         "vite-plugin-node-polyfills": "^0.25.0",
         "vite-plugin-subresource-integrity": "^0.0.12",
         "vitest": "^4.1.11"
@@ -1048,15 +1046,6 @@
       "integrity": "sha512-aGTxbpbg8/b5JfU1HXSrbH3wXZuLPJcNEcZQFMxLs3oSzgtVu6nFPkbbGGUvBcUjKV2YyB9Wxxabo+HEH9tcRQ==",
       "license": "MIT"
     },
-    "node_modules/@hookform/resolvers": {
-      "version": "3.10.0",
-      "resolved": "https://registry.npmjs.org/@hookform/resolvers/-/resolvers-3.10.0.tgz",
-      "integrity": "sha512-79Dv+3mDF7i+2ajj7SkypSKHhl1cbln1OGavqrsF7p6mbUv11xpqpacPsGDCTRvCSjEEIez2ef1NveSVL3b0Ag==",
-      "license": "MIT",
-      "peerDependencies": {
-        "react-hook-form": "^7.0.0"
-      }
-    },
     "node_modules/@humanfs/core": {
       "version": "0.19.2",
       "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
@@ -13303,9 +13292,9 @@
       }
     },
     "node_modules/vite": {
-      "version": "7.3.6",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.6.tgz",
-      "integrity": "sha512-4XP60spRGjSZFf1qYH+dJIkK2znL3zQfl9KkOV9MkkRR/3Dls0dxaBsQPTloEc5BLXWPL9vsOxopxyKoMmDueg==",
+      "version": "7.3.7",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.7.tgz",
+      "integrity": "sha512-AHEzTORMbi7/7aXp7w7KZ5+DCUdSeLsJz0grY8xHpc9DHdYb0vQu6DqJfm2tOw3gDExNgPgnJTXxM6syYFHaCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13912,15 +13901,6 @@
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
       }
-    },
-    "node_modules/zod": {
-      "version": "4.6.7",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz",
-      "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
     }
   }
 }
diff --git a/web/package.json b/web/package.json
index 61d9e361..b735bae3 100644
--- a/web/package.json
+++ b/web/package.json
@@ -21,7 +21,6 @@
     "prepare": "husky"
   },
   "dependencies": {
-    "@hookform/resolvers": "^3.9.0",
     "@noble/ciphers": "^2.1.1",
     "@noble/curves": "^2.0.1",
     "@noble/hashes": "^2.0.1",
@@ -90,8 +89,7 @@
     "sonner": "^1.5.0",
     "tailwind-merge": "^2.5.2",
     "uuid": "^11.1.0",
-    "vaul": "^0.9.3",
-    "zod": "^4.6.7"
+    "vaul": "^0.9.3"
   },
   "overrides": {
     "@pezkuwi/api": "^16.5.39",
@@ -147,7 +145,7 @@
     "tailwindcss-animate": "^1.0.7",
     "typescript": "^5.5.3",
     "typescript-eslint": "^8.0.1",
-    "vite": "^7.3.1",
+    "vite": "^7.3.7",
     "vite-plugin-node-polyfills": "^0.25.0",
     "vite-plugin-subresource-integrity": "^0.0.12",
     "vitest": "^4.1.11"
diff --git a/web/vite.config.ts b/web/vite.config.ts
index 04c72adb..0a750f90 100644
--- a/web/vite.config.ts
+++ b/web/vite.config.ts
@@ -87,7 +87,7 @@ export default defineConfig(({ command }) => ({
           'pezkuwi': ['@pezkuwi/api', '@pezkuwi/extension-dapp', '@pezkuwi/keyring', '@pezkuwi/util', '@pezkuwi/util-crypto'],
           'vendor': ['react', 'react-dom', 'react-router-dom'],
           'ui': ['@radix-ui/react-dialog', '@radix-ui/react-dropdown-menu', '@radix-ui/react-select', '@radix-ui/react-tabs', '@radix-ui/react-toast'],
-          'forms': ['react-hook-form', '@hookform/resolvers', 'zod'],
+          'forms': ['react-hook-form'],
           'i18n': ['i18next', 'react-i18next', 'i18next-browser-languagedetector']
         }
       }