---
issue: 103
title: "Backend: react/react-dom in backend production dependencies"
severity: medium
domain: Dependencies
labels: [backend, dependencies, cleanup]
status: open
created: 2026-05-30
source: Full Codebase Audit 2026-05-30
---

# Backend: react/react-dom in backend production dependencies

**Severity:** medium
**Domain:** Dependencies
**Labels:** backend, dependencies, cleanup

## Description

`backend/package.json:83` lists `react` and `react-dom` as production dependencies. These are large packages with no apparent usage in the backend (no SSR email templates confirmed). They inflate the production bundle and increase the attack surface.

## Options

1. Remove both after confirming zero imports.
2. Move to `devDependencies` if only used in tooling.
3. Keep if some build step requires them.

## Recommendation

Confirm no runtime/SSR usage, then remove. Because removal could break an unseen template render, verify all imports before removing.

## Affected Files

- `backend/package.json:83`

## References

- [Full Codebase Audit 2026-05-30](../09%20-%20Audits/Full%20Codebase%20Audit%20-%202026-05-30.md) — DEC-52