mirror of
https://github.com/pezkuwichain/pwap.git
synced 2026-10-28 05:29:49 +00:00
Neither package is imported anywhere in web/ or shared/. They reached the production bundle only because vite.config.ts named them in the "forms" manual chunk, which forces a module into the build whether or not any code uses it. #61 moved zod to 4.6.7 to clear the advisory; removing it takes the package out of the shipped bundle altogether (abitype declares it as an optional peer, so nothing installs it). The "forms" chunk now holds react-hook-form alone. vite 7.3.7 (2026-10-06) closes the launch-editor advisories on 7.0.0-7.3.6 (Dependabot #313-#315). They reach only the dev server, but the alerts are real. Typecheck ratchet 335/335, 32 tests, build green.