(janitor/dependencies) remove unused @next/third-parties dependency from web

[kilo-code-bot]

Dependencies removed

• @next/third-parties@16.3.3 from apps/web/package.json (runtime dependencies).
• Its now-orphaned transitive dependency third-party-capital@1.0.20 (removed automatically from the lockfile).
• The stale @next/third-parties entry in .github/dependabot.yml ignore.

Evidence each was unused

• @next/third-parties has zero imports, requires, or dynamic imports across the entire monorepo (apps/, services/, packages/, dev/, scripts/, tools/), in every file type (ts, tsx, js, mjs, cjs, json, css).
• No usage of its exported components (GoogleAnalytics, GoogleTagManager, YouTubeEmbed, GoogleMapsEmbed, GoogleReviews, SchemaMarkup, GTag) anywhere in apps/web/src.
• Git history confirms it was never imported in apps/web/src (git log -S "from '@next/third-parties'" returns nothing).
• The functionality it was originally added for (CSP-safe GTM/YouTube third-party scripts) was replaced by custom implementations: src/lib/marketing-tag-scripts.ts (buildGoogleTagManagerScript, served via src/app/api/marketing-tags/gtm/route.ts) and src/components/YouTubeEmbed.tsx.
• knip (already configured for apps/web) reports @next/third-parties in Unused dependencies.
• next.config.mjs only references @next/mdx and @next/bundle-analyzer; it does not reference @next/third-parties.

Dynamic, configuration, and tooling references checked

• No dynamic import() / require() of the package.
• Not referenced by any package.json script (web or root).
• Not referenced by next.config.mjs, postcss.config.mjs, jest.config.ts, playwright.config.ts, knip.ts, or any other config.
• Only configuration reference was the .github/dependabot.yml ignore rule, which was removed alongside the dependency.
• Not a pnpm-workspace.yaml override/catalog entry.

Package publication and peer-dependency considerations

• apps/web is "private": true — it is not published, so removing a dependency has no published-contract impact.
• @next/third-parties was a regular (non-peer) dependency of apps/web; it is not a peer/optional dependency of any package.
• It is a leaf dependency: no other workspace package depends on it (only apps/web declared it).
• Removing it does not create reliance on any transitive dependency (nothing else imports it).

Validation performed

• pnpm install --lockfile-only regenerated the lockfile; diff is limited to @next/third-parties + third-party-capital (20 deletions, no unrelated changes).
• tsgo --noEmit (web typecheck): passed (exit 0).
• oxlint --config .oxlintrc.json apps/web/src: Found 0 warnings and 0 errors.
• Confirmed no remaining references to @next/third-parties in the repo after removal.

Uncertainty

• Web unit/integration tests (jest, playwright) and next build were not run: the sandbox cannot start Postgres/Redis and is memory-constrained. This is low risk because the removed dependency has zero code references, so no test or build path can resolve to it.
• The .github/dependabot.yml still contains similarly stale "Stay on Next.js v15" ignore rules for next and @next/mdx (the app is on Next 16.3.3). These are pre-existing and intentionally left out of scope.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Verified the @next/third-parties removal is safe: no imports or dynamic/require references remain in source or config, the replacement implementations (src/lib/marketing-tag-scripts.ts, src/components/YouTubeEmbed.tsx) exist, and the lockfile entries (importer, package, snapshot, and orphaned third-party-capital) are fully and consistently removed.

Files Reviewed (3 files)

• .github/dependabot.yml - 0 issues (stale ignore entry correctly removed)
• apps/web/package.json - 0 issues
• pnpm-lock.yaml - 0 issues (generated; removal complete and consistent)

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}