chore(ui): add knip for dead code detection

[pfe-nazaries]

Summary

• Install knip and create initial configuration tailored to the Next.js 16 / React 19 project structure
• Add lint:knip and lint:knip:fix scripts to package.json
• Configure entry points for Next.js app conventions, Auth.js, Sentry instrumentation, and build scripts
• Ignore @heroui/* sub-package imports (resolved transitively via @heroui/react)

Baseline report

Running pnpm lint:knip surfaces ~504 issues across the UI codebase:

Category	Count
Unused files	37
Unused dependencies	13
Unused devDependencies	9
Unlisted dependencies	1
Unresolved imports	2
Unused exports	399
Unused exported types	37
Unused exported enum members	5
Duplicate exports	1

These findings will be addressed in follow-up PRs (dependency cleanup, dead export removal, config refinement).

Roadmap

This is the first step in a series of incremental PRs to reduce dead code in the UI:

1. Base knip setup ← this PR
2. Remove unused npm dependencies — drop packages flagged as unused by knip
3. Remove unused exports — clean up barrel re-exports and dead utility functions
4. Refine config for Next.js 16 — tighten entry points for route groups, metadata exports, instrumentation
5. Enforce issue ceiling — lock the clean state with --max-issues in healthcheck
6. CI integration & docs — add dedicated knip step to CI and contributor guidance in AGENTS.md

Dependencies

Note: This PR requires #10653

Test plan

• pnpm typecheck passes
• pnpm lint:check passes
• pnpm build passes
• pnpm lint:knip runs and produces the baseline report (exits non-zero as expected)
• No changes to existing code — config and tooling only

[github-actions]

✅ All necessary CHANGELOG.md files have been updated.

[github-actions]

✅ Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.

[github-actions]

🔒 Container Security Scan

Image: prowler-ui:fc0e88d
Last scan: 2026-04-24 12:18:38 UTC

📊 Vulnerability Summary

Severity	Count
🔴 Critical	2
Total	2

2 package(s) affected

⚠️ Action Required

Critical severity vulnerabilities detected. These should be addressed before merging:

• Review the detailed scan results
• Update affected packages to patched versions
• Consider using a different base image if updates are unavailable

---

📋 Resources:

• Download full report (see artifacts)
• View in Security tab
• Scanned with Trivy

[Alan-TheGentleman]

Three things to address:

1. lint:knip exits non-zero with 504 issues. Anyone running it will think something is broken. Add a note in the PR description or a comment in knip.config.ts explaining the baseline, or consider adding --max-issues 504 so it only fails on regressions. The roadmap mentions this for step 5, but even a code comment now would save confusion.

2. Missing instrumentation.ts entry point. Next.js auto-loads this file for Sentry setup. The config already lists sentry/sentry.server.config.ts and sentry/sentry.edge.config.ts but not the root instrumentation.ts that imports them. Knip will likely flag it as unused.

3. Missing middleware.ts entry point. Same idea. Next.js loads it automatically but knip does not know that unless it is listed explicitly. Add it to the entry array to avoid a false positive.

[Alan-TheGentleman]

All three points from the previous review are addressed — verified against the latest commit.

1. Baseline threshold. lint:knip and lint:knip:fix now run with --max-issues 504, and knip.config.ts has a clear header comment explaining the baseline and pointing at step 5 of the roadmap for reducing it. Exactly what I was after.

2. instrumentation.ts. Not needed in the explicit entry array — knip's built-in Next.js plugin already includes {instrumentation,instrumentation-client,middleware,proxy}.{js,jsx,ts,tsx} in its default entry patterns, and since this config only overrides root-level entry (not plugins.next.entry), the plugin defaults still apply. Good call documenting it inline.

3. middleware.ts. My original comment was outdated — this repo is on Next.js 16, where middleware.ts was renamed to proxy.ts. The file exists at ui/proxy.ts and is covered by the same Next.js plugin default pattern.

LGTM. Thanks for the clean follow-up and the explanatory comments in the config — they make the intent obvious for the next person who opens the file.