[JSv4]

Summary

Follow-up to #2420. @graphql-codegen/cli was in frontend devDependencies with no codegen config, no script, and no import anywhere in the frontend (generated types in src/types/graphql-api.ts are maintained by hand). This removes it, along with the @graphql-codegen/cli/yaml resolution that existed only for it.

Effect on the lockfile: 230 entries / 1,635 lines pruned, including all 27 @graphql-tools/* packages. That is the dev-only transitive chain behind #2420 (@graphql-tools/executor-legacy-ws, @graphql-tools/utils@12, @whatwg-node/promise-helpers@2), so it can no longer generate Dependabot alerts. Nothing else in the tree depended on any of it.

Phantom dependency fixed: frontend/scripts/env.js (run by yarn build and yarn start) requires dotenv, which was only ever installed transitively via @graphql-tools/prisma-loader inside the codegen tree. Removing the cli broke the build until dotenv@^16.6.1 (the version it was already resolving to) was declared explicitly.

Verification (local, Node 24)

• yarn install --frozen-lockfile: pass
• yarn build (tsc + vite): pass
• yarn run lint (prettier) and yarn run any:check:strict: pass
• Vitest: 2644 tests in 174 files pass

Noted, not changed

frontend/scripts/generate-brand-pngs.js imports playwright without declaring it; @playwright/test still supplies it, so it is unaffected here. Worth declaring in a separate change.

[claude]

Review: clean, well-scoped dependency cleanup. Checked against the repo:

• Removal is safe: no codegen config, script, or import remains in frontend/ or .github/. The @graphql-codegen/cli/yaml resolution only applied to that package.
• dotenv fix is correct: frontend/scripts/env.js:3 requires dotenv, so declaring it explicitly (^16.6.1, the version already resolved) removes a real phantom dependency. devDependencies is fine if env.js only runs for build/start. If a production image runs yarn build after a production-only install, it would need to be in dependencies, so please confirm.
• The changelog fragment follows the changelog.d/ convention.

Minor, non-blocking:

1. Three docs still reference codegen, which no longer exists. CLAUDE.md asks for docs to be updated in the same change.
   • docs/features/corpus_folders_implementation.md:430 says 'Run codegen to generate TypeScript types'. That is misleading now, since the types are hand-maintained.
   • docs/frontend/any-baseline.md:92 says '(or the GraphQL codegen output)'.
   • docs/architecture/social-media-previews.md:14 says 'e.g., for codegen'.
2. I did not re-run yarn install --frozen-lockfile or the build myself. I'm relying on the PR's stated verification, and CI should confirm.
3. The playwright phantom-dependency note is fine to defer. A follow-up issue would keep it from getting lost.

No bugs, security, or performance concerns. Good to merge once the doc references are cleaned up.

[claude]

Review

This is a clean dependency removal and I found nothing blocking.

• Codegen is unused. A repo-wide grep finds no codegen config, script or import outside the lockfile and changelog entries. Removing @graphql-codegen/cli and its yaml resolution is safe.
• dotenv fix is right. frontend/scripts/env.js requires dotenv. It is now declared as ^16.6.1 and the lockfile entry resolves to 16.6.1, so the version doesn't change.
• Docs and changelog. The doc edits are consistent, and the fragment follows the changelog.d/ convention. The slug has no PR number, which is fine.
• Verification. The PR reports install, build, lint and Vitest passing. I didn't re-run them.

Optional nits:

• The lockfile diff is large. If CI is green on yarn install --frozen-lockfile, that is enough to confirm it.
• playwright is imported undeclared in generate-brand-pngs.js. The PR already flags this for a follow-up.

LGTM.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!