[kilo-code-bot]

Summary

Remove a single unused dependency, @next/third-parties, from apps/web. This is the highest-confidence unused-dependency finding after cross-referencing knip static analysis with repository-wide manual verification. No other dependency is touched.

Dependencies removed

• @next/third-parties@16.3.3 (from apps/web/package.json dependencies)
• third-party-capital@1.0.20 — removed from pnpm-lock.yaml because it was an exclusive transitive dependency of @next/third-parties (zero remaining references after removal)

Evidence each was unused

• No source references. @next/third-parties appears in zero imports, requires, dynamic import()s, or type references anywhere in the repository (apps/, services/, packages/, dev/, scripts/). The only non-package.json occurrence is apps/web/src/tests/req_sample/anthropic-claude37.log.req.json, a captured request fixture that embeds an unrelated project's (kilocode-backend) package.json text — not a consumer of this package.
• No component usage. The app has its own src/components/YouTubeEmbed.tsx (used by WelcomeContent.tsx); it does not use @next/third-parties' YouTubeEmbed/GoogleAnalytics/GoogleMaps/GoogleTagManager/GoogleRecaptcha components.
• knip agreement. pnpm --filter web knip lists @next/third-parties under "Unused dependencies" (package.json:74:6), independent of the manual grep.

Dynamic, configuration, and tooling references checked

• Config files: Not referenced in next.config.*, jest.config.ts, tsconfig*.json, .dependency-cruiser.js, knip.ts, or pnpm-workspace.yaml (no overrides/packageExtensions/catalog entry).
• Scripts: Not referenced by any package.json script in apps/web or the root workspace.
• Framework/tooling: @next/third-parties is a plain React component library (opt-in via imports), not a Next.js/compiler plugin, preset, loader, runtime adapter, or code-generation tool.
• Side effects / naming convention: Not loaded for side effects and not discovered by convention (Next.js does not auto-detect it).
• Known leftover (not a consumer): .github/dependabot.yml still lists @next/third-parties in its ignore block with a stale "Stay on Next.js v15 for now" comment. This is an ignore directive, not a consumer, and the whole block (next, @next/mdx, @next/third-parties) is already stale because the app is on Next.js 16. Left untouched to keep this change scoped to the dependency removal.

Package publication and peer-dependency considerations

• apps/web ("name": "web", "private": true) is a private workspace package, so there is no published-package contract or peer/optional dependency surface affected.
• @next/third-parties is not a peer dependency of any package in this repository, and nothing depends on it. Its own peer dependencies (next, react) remain satisfied and unchanged.

Validation performed

• Clean install / lockfile: Ran pnpm install --lockfile-only; confirmed the only lockfile changes are the removal of @next/third-parties (importer entry, package entry, peer-resolved snapshot) and third-party-capital (package entry + snapshot). Verified with pnpm install --frozen-lockfile --lockfile-only that the edited lockfile is consistent with package.json.
• Lint: pnpm --filter web lint — 0 warnings, 0 errors (3910 files).
• Typecheck: pnpm --filter web typecheck — passed (exit 0), including the @kilocode/trpc build step.
• Tests: Could not be executed. The Jest global setup (src/tests/setup/workerSetup.ts) connects to PostgreSQL to clean tables before any test runs; PostgreSQL is unavailable in this environment (resource-constrained sandbox, as noted). The failure is a pre-existing environment limitation, not related to this change.
• Build: next build was not run (memory/time-constrained sandbox; also depends on DB-backed setup). Given zero source references to the removed package, build impact is expected to be nil.

Uncertainty

• The stale .github/dependabot.yml ignore entry for @next/third-parties was intentionally left in place (its sibling next/@next/mdx entries are equally stale). Removing or refreshing that block is out of scope here but could be a small follow-up.
• knip also reports many @kilocode/* workspace packages and shared libs (e.g. eventsource-parser, mailgun.js, @sentry/opentelemetry) as "unused" from apps/web; manual verification shows these are consumed by packages/web-shared (a workspace dependency), so they were not removed — they are not true duplicates from apps/web's perspective and would require a separate, more involved workspace-boundary analysis.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Removing the unused @next/third-parties dependency and its exclusive transitive third-party-capital from the lockfile is safe; repository-wide search confirms no source, test, or config references remain, and only the private apps/web workspace is affected.

Files Reviewed (2 files)

• apps/web/package.json - dependency removal only; no references in source, tests, or config
• pnpm-lock.yaml - generated lockfile; importer, package, and snapshot entries for both packages removed consistently

---

_{Reviewed by deepseek-v4.1-flash · Input: 78.9K · Output: 2K · Cached: 153.6K}

_{Review guidance: REVIEW.md from base branch main}