From b50b5fcd2180f45a65bbad1dbf12875c5ff83686 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Tue, 20 Oct 2026 08:39:06 +0200
Subject: [PATCH] chore(deps): drop four dependencies nothing imports

react-hook-form, @hookform/resolvers, next-themes and @vitejs/plugin-react
have no import anywhere in src/, scripts/, tests/, e2e/ or the build and
test configs; knip only stayed quiet because each sat on its ignore list.
Forms keep a controlled draft and validate with the shared Zod schemas,
and the theme bootstrap is hand-written. The ignore entries, the comments
that still named the form library, and the guideline text go with them.
---
 docs/ui-guidelines.md                         |   6 +-
 knip.jsonc                                    |   4 -
 package.json                                  |   4 -
 pnpm-lock.yaml                                | 150 ------------------
 pnpm-workspace.yaml                           |   5 +-
 .../dashboard/quick-entry-forms.lazy.tsx      |   2 +-
 src/components/ui/date-field.tsx              |   4 +-
 .../vaccinations/vaccination-form.tsx         |   2 +-
 8 files changed, 9 insertions(+), 168 deletions(-)

diff --git a/docs/ui-guidelines.md b/docs/ui-guidelines.md
index f908d4c2a..4adc25d80 100644
--- a/docs/ui-guidelines.md
+++ b/docs/ui-guidelines.md
@@ -132,7 +132,8 @@ helper text explaining why. Silent disabled buttons frustrate users.
 
 ### 2.2 Inputs and forms
 
-We use `react-hook-form` + Zod schemas from `src/lib/validations/`.
+Forms keep a controlled draft in component state and validate it with the
+Zod schemas from `src/lib/validations/`; the server's schema is the authority.
 Wrap inputs in `<label>` (visible) plus `aria-describedby` for helper text.
 
 - **Text / number / email**: `<Input>`. Always set `autocomplete`. See §4.4.
@@ -425,8 +426,7 @@ control. Behavior:
 
 ### 4.6 Server actions and mutations
 
-We use `react-hook-form` + TanStack Query mutations, never raw fetch
-calls in components. Every mutation:
+Mutations go through TanStack Query, never raw fetch calls in components. Every mutation:
 
 1. Optimistically updates the cache with a rollback handler.
 2. Toast on success ("Saved" — translated) and on error (with retry).
diff --git a/knip.jsonc b/knip.jsonc
index 50a7b35a4..46380cd23 100644
--- a/knip.jsonc
+++ b/knip.jsonc
@@ -134,11 +134,7 @@
     "@types/node",
     "@types/react",
     "@types/react-dom",
-    "@hookform/resolvers",
-    "react-hook-form",
     "@prisma/client",
-    "next-themes",
-    "@vitejs/plugin-react",
     "shadcn",
     "tailwindcss",
     "testcontainers",
diff --git a/package.json b/package.json
index bc81db282..5b0f5b5db 100644
--- a/package.json
+++ b/package.json
@@ -58,7 +58,6 @@
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
-    "@hookform/resolvers": "^5.9.1",
     "@modelcontextprotocol/sdk": "^1.32.1",
     "@napi-rs/canvas": "1.0.11",
     "@node-rs/argon2": "^2.2.2",
@@ -81,7 +80,6 @@
     "lucide-react": "^1.56.0",
     "mmdb-lib": "^3.0.3",
     "next": "16.3.8",
-    "next-themes": "^0.4.6",
     "nodemailer": "10.1.0",
     "otpauth": "^9.5.2",
     "p-limit": "^7.3.3",
@@ -93,7 +91,6 @@
     "react": "19.3.0",
     "react-day-picker": "^10.0.2",
     "react-dom": "19.3.0",
-    "react-hook-form": "7.90.0",
     "recharts": "^3.10.1",
     "rrule": "^2.8.1",
     "sax": "^1.6.1",
@@ -121,7 +118,6 @@
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
     "@types/web-push": "^3.6.4",
-    "@vitejs/plugin-react": "^6.1.2",
     "@vitest/coverage-v8": "^5.0.4",
     "ajv": "^8.20.0",
     "eslint": "^9",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index cc42cfac7..6a9f052b4 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -56,9 +56,6 @@ importers:
       '@dnd-kit/utilities':
         specifier: ^3.2.2
         version: 3.2.2(react@19.3.0)
-      '@hookform/resolvers':
-        specifier: ^5.9.1
-        version: 5.9.1(@standard-schema/spec@1.1.0)(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(effect@3.20.0)(react-hook-form@7.90.0(@types/react@19.3.0)(react@19.3.0))(valibot@1.4.2(typescript@6.0.3))(zod@4.6.7)
       '@modelcontextprotocol/sdk':
         specifier: ^1.32.1
         version: 1.32.1(@cfworker/json-schema@4.1.1)(supports-color@7.2.0)(zod@4.6.7)
@@ -125,9 +122,6 @@ importers:
       next:
         specifier: 16.3.8
         version: 16.3.8(@babel/core@7.29.7(supports-color@7.2.0))(@opentelemetry/api@1.9.1)(@playwright/test@1.64.0)(@types/node@26.6.5)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      next-themes:
-        specifier: ^0.4.6
-        version: 0.4.6(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
       nodemailer:
         specifier: 10.1.0
         version: 10.1.0
@@ -161,9 +155,6 @@ importers:
       react-dom:
         specifier: 19.3.0
         version: 19.3.0(react@19.3.0)
-      react-hook-form:
-        specifier: 7.90.0
-        version: 7.90.0(@types/react@19.3.0)(react@19.3.0)
       recharts:
         specifier: ^3.10.1
         version: 3.10.1(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react-is@16.13.1)(react@19.3.0)(redux@5.0.1)
@@ -240,9 +231,6 @@ importers:
       '@types/web-push':
         specifier: ^3.6.4
         version: 3.6.4
-      '@vitejs/plugin-react':
-        specifier: ^6.1.2
-        version: 6.1.2(vite@8.1.5(@types/node@26.6.5)(jiti@2.7.0)(yaml@2.9.1))
       '@vitest/coverage-v8':
         specifier: ^5.0.4
         version: 5.0.4(vitest@5.0.4)
@@ -683,84 +671,6 @@ packages:
     peerDependencies:
       hono: ^4.13.5
 
-  '@hookform/resolvers@5.9.1':
-    resolution: {integrity: sha512-7b7vsbraJxKgjVSA1Nur9tLwj539WGJUBLA7QNvXnFoT2pM5Z7G+6rlukk4B2/QrTZy6huRtH6wKeESPKuIr6w==}
-    peerDependencies:
-      '@sinclair/typebox': '>=0.25.24'
-      '@standard-schema/spec': ^1.0.0
-      '@typeschema/main': '>=0.13.7'
-      '@vinejs/vine': ^2.0.0 || ^3.0.0 || ^4.0.0
-      ajv: ^8.12.0
-      ajv-errors: ^3.0.0
-      ajv-formats: ^2.1.1
-      arktype: ^2.0.0
-      ata-validator: ^1.2.0
-      class-transformer: '>=0.4.0'
-      class-validator: '>=0.12.0'
-      computed-types: ^1.0.0
-      effect: ^3.10.3
-      fluentvalidation-ts: ^3.0.0
-      fp-ts: ^2.7.0
-      io-ts: ^2.0.0
-      joi: ^17.0.0 || ^18.0.0
-      nope-validator: '>=0.12.0'
-      react-hook-form: ^7.55.0
-      superstruct: '>=0.12.0'
-      typanion: ^3.3.2
-      valibot: ^1.4.2
-      vest: '>=6.0.0'
-      yup: ^1.0.0
-      zod: ^3.25.0 || ^4.0.0
-    peerDependenciesMeta:
-      '@sinclair/typebox':
-        optional: true
-      '@standard-schema/spec':
-        optional: true
-      '@typeschema/main':
-        optional: true
-      '@vinejs/vine':
-        optional: true
-      ajv:
-        optional: true
-      ajv-errors:
-        optional: true
-      ajv-formats:
-        optional: true
-      arktype:
-        optional: true
-      ata-validator:
-        optional: true
-      class-transformer:
-        optional: true
-      class-validator:
-        optional: true
-      computed-types:
-        optional: true
-      effect:
-        optional: true
-      fluentvalidation-ts:
-        optional: true
-      fp-ts:
-        optional: true
-      io-ts:
-        optional: true
-      joi:
-        optional: true
-      nope-validator:
-        optional: true
-      superstruct:
-        optional: true
-      typanion:
-        optional: true
-      valibot:
-        optional: true
-      vest:
-        optional: true
-      yup:
-        optional: true
-      zod:
-        optional: true
-
   '@humanfs/core@0.19.2':
     resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==}
     engines: {node: '>=18.18.0'}
@@ -3166,22 +3076,6 @@ packages:
   '@visx/vendor@4.0.0-alpha.0':
     resolution: {integrity: sha512-6I+MuqXBcv9jnlcVowHoHKSdk9gXTWkHLKyqBwRWg7LY6A3Ei8SHfubpqGV5rBUSppxMq2RszPJUS6w+H0YgmQ==}
 
-  '@vitejs/plugin-react@6.1.2':
-    resolution: {integrity: sha512-fhJNGUdscQa4HkI0xFxwonWyhnVReCPDbXI7FH7jmzpnVCrFQI7PRrhWecO263610vOrs9tr2Y4xcf8uAdFxbw==}
-    engines: {node: ^20.19.0 || >=22.12.0}
-    peerDependencies:
-      '@rolldown/plugin-babel': ^0.1.7 || ^0.2.0
-      babel-plugin-react-compiler: ^1.0.0
-      oxc-transform-react: ^0.152.0
-      vite: ^8.0.0
-    peerDependenciesMeta:
-      '@rolldown/plugin-babel':
-        optional: true
-      babel-plugin-react-compiler:
-        optional: true
-      oxc-transform-react:
-        optional: true
-
   '@vitest/coverage-v8@5.0.4':
     resolution: {integrity: sha512-P5YcQY8Y6RmoE9xRXI38rT8pssbcubEzqtYTM2XQoxOXMDn04nRaTI1SM8qCl9/NfW3ag9GlzdSXu7IwO5Ft8A==}
     peerDependencies:
@@ -5305,12 +5199,6 @@ packages:
     resolution: {integrity: sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==}
     engines: {node: '>= 0.6'}
 
-  next-themes@0.4.6:
-    resolution: {integrity: sha512-pZvgD5L0IEvX5/9GWyHMf3m8BKiVQwsCMHfoFosXtXBMnaS0ZnIJ9ST4b4NqLVKDEm8QBxoNNGNaBv2JNF6XNA==}
-    peerDependencies:
-      react: ^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc
-      react-dom: ^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc
-
   next@16.3.8:
     resolution: {integrity: sha512-U7QEZaTini6wKrb8A8hqLLqYQyCetegKjCpJOyxk642vWoMoU1x5PyZCJFvgYgiptA8xc5j/9xYlZFO7w9Sjmw==}
     engines: {node: '>=20.9.0'}
@@ -5880,16 +5768,6 @@ packages:
     peerDependencies:
       react: ^19.3.0
 
-  react-hook-form@7.90.0:
-    resolution: {integrity: sha512-+NdG0FLzCPhFOp2NNxaUYLF9fyZhNjx9FTBBSYWF71/l6BBlmIc/j6xlp3DbaHWLJbIG7Zd8oznA19xJClU97w==}
-    engines: {node: '>=18.0.0'}
-    peerDependencies:
-      '@types/react': '*'
-      react: ^16.8.0 || ^17 || ^18 || ^19
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-
   react-is@16.13.1:
     resolution: {integrity: sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==}
 
@@ -7508,18 +7386,6 @@ snapshots:
     dependencies:
       hono: 4.13.7
 
-  '@hookform/resolvers@5.9.1(@standard-schema/spec@1.1.0)(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(effect@3.20.0)(react-hook-form@7.90.0(@types/react@19.3.0)(react@19.3.0))(valibot@1.4.2(typescript@6.0.3))(zod@4.6.7)':
-    dependencies:
-      '@standard-schema/utils': 0.3.0
-      react-hook-form: 7.90.0(@types/react@19.3.0)(react@19.3.0)
-    optionalDependencies:
-      '@standard-schema/spec': 1.1.0
-      ajv: 8.20.0
-      ajv-formats: 2.1.1(ajv@8.20.0)
-      effect: 3.20.0
-      valibot: 1.4.2(typescript@6.0.3)
-      zod: 4.6.7
-
   '@humanfs/core@0.19.2':
     dependencies:
       '@humanfs/types': 0.15.0
@@ -9848,11 +9714,6 @@ snapshots:
       d3-time-format: 4.1.0
       internmap: 2.0.3
 
-  '@vitejs/plugin-react@6.1.2(vite@8.1.5(@types/node@26.6.5)(jiti@2.7.0)(yaml@2.9.1))':
-    dependencies:
-      '@rolldown/pluginutils': 1.0.1
-      vite: 8.1.5(@types/node@26.6.5)(jiti@2.7.0)(yaml@2.9.1)
-
   '@vitest/coverage-v8@5.0.4(vitest@5.0.4)':
     dependencies:
       '@bcoe/v8-coverage': 1.0.2
@@ -12056,11 +11917,6 @@ snapshots:
 
   negotiator@1.0.0: {}
 
-  next-themes@0.4.6(react-dom@19.3.0(react@19.3.0))(react@19.3.0):
-    dependencies:
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
-
   next@16.3.8(@babel/core@7.29.7(supports-color@7.2.0))(@opentelemetry/api@1.9.1)(@playwright/test@1.64.0)(@types/node@26.6.5)(react-dom@19.3.0(react@19.3.0))(react@19.3.0):
     dependencies:
       '@next/env': 16.3.8
@@ -12676,12 +12532,6 @@ snapshots:
       react: 19.3.0
       scheduler: 0.28.0
 
-  react-hook-form@7.90.0(@types/react@19.3.0)(react@19.3.0):
-    dependencies:
-      react: 19.3.0
-    optionalDependencies:
-      '@types/react': 19.3.0
-
   react-is@16.13.1: {}
 
   react-redux@9.2.0(@types/react@19.3.0)(react@19.3.0)(redux@5.0.1):
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 5e1ffece7..e98b2596f 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -78,9 +78,8 @@ overrides:
   # override is the only way through. It runs on the config-loading and CLI
   # path, not under a request, but a red audit blocks the whole release train.
   "deepmerge-ts@<8.0.0": "^8.0.0"
-  # CVE-2026-59952. Two copies arrive, neither of them ours to call: an
-  # optional peer of `@hookform/resolvers` (this app validates with zod) and
-  # prisma's local dev server. Mirrored for /opt/prisma-cli in the Dockerfile,
+  # CVE-2026-59952. The copy arrives through prisma's local dev server, not
+  # ours to call. Mirrored for /opt/prisma-cli in the Dockerfile,
   # where the flagged 1.2.0 landed. 1.4.2 is the same major, so no consumer is
   # dragged onto a new one.
   "valibot@<1.4.2": "^1.4.2"
diff --git a/src/components/dashboard/quick-entry-forms.lazy.tsx b/src/components/dashboard/quick-entry-forms.lazy.tsx
index 1a4ed22e7..40cf04080 100644
--- a/src/components/dashboard/quick-entry-forms.lazy.tsx
+++ b/src/components/dashboard/quick-entry-forms.lazy.tsx
@@ -4,7 +4,7 @@
  * The quick-entry forms, loaded when a sheet first opens rather than with the
  * page. The dashboard and the bottom bar's capture picker are on nearly every
  * authenticated paint, and both used to import all five forms eagerly (each
- * with react-hook-form, zod, its pickers and its own queries) for sheets most
+ * with zod, its pickers and its own queries) for sheets most
  * visits never open.
  *
  * Client-only (`ssr: false`): every sheet is closed on the server render. The
diff --git a/src/components/ui/date-field.tsx b/src/components/ui/date-field.tsx
index 95b427c6f..e00b4d4f9 100644
--- a/src/components/ui/date-field.tsx
+++ b/src/components/ui/date-field.tsx
@@ -38,7 +38,7 @@ const DateFieldCalendar = dynamic(
  *
  * The committed VALUE is always ISO `yyyy-MM-dd` — identical to the native
  * `<input type="date">` contract `<DateInput>` ships — so this is a drop-in
- * for `<DateInput>` and existing react-hook-form wiring is unchanged.
+ * for `<DateInput>` and existing form wiring is unchanged.
  *
  * How it works:
  *   - A text overlay paints the formatted display string (or the placeholder)
@@ -52,7 +52,7 @@ const DateFieldCalendar = dynamic(
  *     quirks) is gone.
  *   - A hidden mirror input carries `name` + the ISO value so any caller that
  *     relies on native form submission still sees a normal field; the forwarded
- *     ref points at it for react-hook-form `register()` parity.
+ *     ref points at it, so a caller reads it like any native input.
  *
  * Height / a11y / target-size parity with `<DateInput>`: the same
  * `min-h-11 h-11 sm:min-h-10 sm:h-10` floor (WCAG 2.5.5 — 44 px on mobile,
diff --git a/src/components/vaccinations/vaccination-form.tsx b/src/components/vaccinations/vaccination-form.tsx
index bdb30c955..af771e78b 100644
--- a/src/components/vaccinations/vaccination-form.tsx
+++ b/src/components/vaccinations/vaccination-form.tsx
@@ -17,7 +17,7 @@
  * new definition can be added from it without leaving the form.
  *
  * Follows the encounter form's controlled-draft shape rather than a
- * react-hook-form instance — the sibling surface this plan cites as its
+ * form-library instance — the sibling surface this plan cites as its
  * precedent uses a draft, and the server's Zod schema is the validation
  * authority either way. The client guard is for the two properties a person
  * feels immediately: a date is present, and the vaccine is named somehow.