chore(deps): declare 3 direct imports Knip flagged as unlisted

[njrini99-code]

Summary

Phase 10 of the HelmV3 stabilization brief. npm run knip:deps (tuned in #773) reports 3 unlisted-dependency findings — all genuinely imported, just missing from package.json because they were only ever resolved transitively.

• @radix-ui/react-compose-refs — imported directly by Fairway's tabs component (src/components/fairway/controls/tabs.tsx).
• fflate — imported directly by the Baseball XLSX/PDF stat-import adapters (src/lib/baseball/adapters/{xlsx,pdf}-reader.ts).
• postcss-load-config — referenced as a JSDoc type import in postcss.config.mjs (added as a devDependency: build-time type only, not runtime).

Verified via grep before adding — all three have real usages. Versions pinned to what npm already resolves transitively today, so this is a manifest correction, not a version bump.

Test plan

• npm run typecheck — clean.
• npm run test:run — 428 files / 4398 passed, 39 skipped (unchanged from main).
• npm run build — succeeds.

Made with Cursor

[supabase]

This pull request has been ignored for the connected project qmnssrrolpinvwjjnufo because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
helmv3	Ignored	Preview	Jul 3, 2026 9:54pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 101ccc93-e5fb-433e-a897-0857038c04de

📥 Commits

Reviewing files that changed from the base of the PR and between 8b9986e and 148b73b.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

Summary by CodeRabbit

• Chores
  • Added support packages to improve the app’s build and UI capabilities.
  • Updated development tooling dependencies to better support configuration handling.

Walkthrough

package.json:88, 120, and 169 add three new dependency entries: @radix-ui/react-compose-refs and fflate under dependencies, and postcss-load-config under devDependencies. No other files, exports, or version bumps are changed.

Changes

Dependency additions

Layer / File(s)	Summary
New dependency entries package.json	Adds @radix-ui/react-compose-refs (dependencies), fflate (dependencies), and postcss-load-config (devDependencies).

Estimated code review effort: 1 (Trivial) | ~3 minutes

Related issues: None specified in the provided diff.

Related PRs: None specified in the provided diff.

Suggested labels: dependencies

Suggested reviewers: None specified — assign based on package ownership for package.json.

package.json:88 — verify @radix-ui/react-compose-refs is actually imported/used somewhere; unused deps bloat install size.
package.json:120 — fflate added but no usage shown in this diff; confirm consumer code exists.
package.json:169 — postcss-load-config is devDependency; confirm PostCSS build config actually references it, otherwise drop it.

No sequence diagram generated — this PR is a config/dependency-only change with no control flow to visualize.

Poem

Three new lines in a manifest deep,
No logic changed, no secrets to keep,
Compose-refs, fflate, postcss's friend—
Just deps added, diff at its end. 🐰

🚥 Pre-merge checks | ✅ 12

✅ Passed checks (12 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title matches the manifest-only dependency update and uses the required Conventional Commits deps scope.
Description check	✅ Passed	The description accurately summarizes the three dependency additions and their usage, matching the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Service-Role In Client Bundles	✅ Passed	Only package.json and package-lock.json changed; neither contains SUPABASE_SERVICE_ROLE_KEY or createClient service-role usage.
Rls Coverage On New Tables	✅ Passed	Diff only changes package.json and package-lock.json; no migration files were touched, so the RLS check is not applicable.
Auth Check In Server Actions	✅ Passed	No changed file matches src/app//actions//*.ts; this PR only touches package.json and package-lock.json.
Sport-Prefixed Table Names	✅ Passed	PASS: diff only touches package.json and package-lock.json; no changed .ts/.tsx files to audit for Supabase table queries.
No Destructive Writes	✅ Passed	PASS: PR only changes package.json/package-lock.json dependency entries (package.json:85,117,166); no save/submit/sync code or DELETE/INSERT paths were modified.
No Edits To Historical Migrations	✅ Passed	Diff only changes package.json and package-lock.json; no files under supabase/migrations/ are modified.
Conventional Commits	✅ Passed	PR #779 title is "chore(deps): declare 3 direct imports Knip flagged as unlisted" and HEAD subject matches it; both satisfy the Conventional Commits regex.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/knip-direct-dependencies

• 🛠️ helm safety pass
• 🛠️ dashboard ux pass
• 🛠️ rls test pass

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ast-grep (0.44.0)

ast-grep could not parse rule config: /ast-grep-rules/../git/.coderabbit/ast-grep/no-explicit-any.yml

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Declare Knip-unlisted direct dependencies in package.json

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Add missing direct dependencies reported by knip:deps to avoid transitive-only resolution.
• Declare @radix-ui/react-compose-refs and fflate as runtime dependencies.
• Add postcss-load-config as a devDependency for build-time type references.

High-Level Assessment

The following are alternative approaches to this PR:

1. Suppress/ignore Knip findings

• ➕ Avoids adding direct dependencies to the manifest
• ➕ Keeps dependency surface area smaller
• ➖ Continues relying on transitive resolution, increasing fragility across dependency graph changes
• ➖ Weakens the signal of knip:deps and can mask real missing deps later

2. Refactor to remove direct imports

• ➕ Eliminates the need for additional dependencies (e.g., replace fflate usage or avoid Radix internal helper)
• ➖ More code churn and risk than a manifest correction
• ➖ May not be feasible without losing functionality or re-implementing behavior

3. Isolate type-only tooling deps via dedicated TS types or config pattern

• ➕ Could avoid adding postcss-load-config if a stable ambient type or alternative typing approach exists
• ➖ Usually more complex than declaring the devDependency
• ➖ May reduce clarity versus explicitly listing the referenced package

Recommendation: Proceed with declaring the dependencies directly. For runtime imports (@radix-ui/react-compose-refs, fflate), explicit dependencies are the most robust approach and prevents future breakage when transitive trees change. For the type-only postcss-load-config reference, listing it as a devDependency is a clear and maintainable fix; suppressing Knip would trade short-term cleanliness for longer-term fragility.

Files changed (1) +3 / -0

Other (1) +3 / -0

package.jsonAdd three previously-transitive dependencies flagged by Knip +3/-0

Add three previously-transitive dependencies flagged by Knip

• Adds '@radix-ui/react-compose-refs' and 'fflate' to dependencies to match direct production imports. Adds 'postcss-load-config' to devDependencies to satisfy a build-time type reference and eliminate Knip unlisted-dependency findings.

package.json

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review