[IvanAfoninCoinbase]

What changed? Why?

@coinbase/eslint-plugin-cds declares @coinbase/cds-common, @coinbase/cds-mobile and @coinbase/cds-web as required peerDependencies, but it never imports them. The rules only compare import sources in the code being linted against those package names (for example the package list in src/rules/no-v7-imports.ts and the allowedPackages lists in the a11y rules).

Installers that auto-install required peers (pnpm, Bun, npm 7+) therefore install @coinbase/cds-mobile for every consumer of the lint plugin, and with it react-native and the rest of its peer tree. Web-only repos that only want the lint rules end up with React Native in node_modules; in frontend/coinbase-www that is roughly 10k+ extra files.

This PR:

• removes the three CDS packages from peerDependencies in packages/eslint-plugin-cds/package.json. They stay in devDependencies, so the workspace setup and the yarn.config.cjs peer/dev sync are unchanged;
• updates the workspace entry in yarn.lock to match (three peerDependencies lines removed; no resolutions change);
• adds a patch version plan, .nx/version-plans/eslint-plugin-cds-drop-cds-peers.md.

Root cause (required for bugfixes)

The peers were declared as required, with no peerDependenciesMeta entry, although the plugin has no runtime or type dependency on them.

Evidence:

• grep -rnE "(from|require\(|import\()\s*['\"]@coinbase/cds-(common|mobile|web)" packages/eslint-plugin-cds/src finds nothing (exit 1). The names appear only as string literals.
• The published @coinbase/eslint-plugin-cds@3.5.0 lib/ requires only @typescript-eslint/utils, eslint-plugin-jsx-a11y and eslint-plugin-react-native-a11y.
• npm view @coinbase/eslint-plugin-cds@3.5.0 peerDependencies lists @coinbase/cds-common, @coinbase/cds-mobile and @coinbase/cds-web at ^9.8.0, with no peerDependenciesMeta.
• The test files import CDS packages only inside RuleTester code strings, which are parsed and never resolved.

Separate from this PR: lib/ requires @typescript-eslint/utils at runtime, but the package lists it only in devDependencies. I left it alone to keep this change narrow.

UI changes

None. This only changes package metadata.

Testing

How has it been tested?

• Unit tests
• Interaction tests
• Pseudo State tests
• Manual - Web
• Manual - Android (Emulator / Device)
• Manual - iOS (Emulator / Device)

I did not run a local install or build for this metadata-only change. Instead I checked the source with grep, inspected the published 3.5.0 tarball (npm pack), and compared it with the registry metadata. CI covers yarn install --immutable and the eslint-plugin-cds tests.

Screen recording

Real terminal session (Python pty, replayed in xterm.js and captured with Playwright recordVideo, 1600×1000, about 31 s) of commit 546d0b42 on macOS. It shows the branch diff (peers before and after), the version plan, a grep showing that src/ never imports the removed peers, the published 3.5.0 peerDependencies from npm view, the @coinbase/cds-mobile peers that get pulled in as a result, and every external require() in the published lib/. It does not show an actual pnpm or Bun install.

Recording: attached below by the author (GitHub CLI uploads need write access to this repository).

Testing instructions

grep -rnE "(from|require\(|import\()\s*['\"]@coinbase/cds-(common|mobile|web)" packages/eslint-plugin-cds/src; echo $?   # 1
npm view @coinbase/eslint-plugin-cds peerDependencies

Release and follow-ups

• Release: this PR adds only the version plan (patch for eslint-plugin-cds). The new version is published once a maintainer runs yarn release (here or in a later batch) and the bump lands on master.
• Internal sync: the CDS team syncs this change into cds-internal (@cbhq/eslint-plugin-cds).
• Downstream: frontend/nx-tools packages/eslint-plugin depends on @cbhq/eslint-plugin-cds ^0.0.3. It will need to be bumped to the released fixed version before consumers such as frontend/coinbase-www stop installing React Native.

Illustrations/Icons Checklist

Required if this PR changes files under packages/illustrations/** or packages/icons/**

Not applicable.

Change management

type=routine
risk=low
impact=sev5

automerge=false

[cb-heimdall]

✅ Heimdall Review Status

Requirement	Status	More Info
Reviews	✅ 1/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 1 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1
CODEOWNERS	✅ See below

✅ CODEOWNERS

Code Owner	Status	Calculation
ui-systems-eng-team	✅ 1/1	Denominator calculation Additional CODEOWNERS Requirement Show calculation Sum 0 0 From CODEOWNERS 1 Sum 1