AI Code Review

⚠️ Approved with suggestions — low-severity items only, safe to merge

What was reviewed

Skipped (out of scope): pnpm-lock.yaml (lockfile), typings/*.d.ts (generated), __snapshots__/*.snap (auto-generated)

Findings

⚠️ Low — Wildcard rollup specifier in automation package

File: pnpm-lock.yaml (automation importer, two occurrences)
Note: The rollup specifier changed from the pinned '3.29' to '*', which resolved to 4.61.1 at lock time. The lockfile pins the resolved version, so this is safe for reproducible installs. However, a wildcard * means a future pnpm update could silently upgrade to a breaking rollup 5.x. Consider pinning to '^4' or '4' rather than '*' to keep the intent explicit.

⚠️ Low — checkNodeVersion() disabled silently via patch

File: patches/@mendix__pluggable-widgets-tools.patch line 7
Note: The comment // Disabled via pnpm patch explains that it is disabled, but not why. If this is needed because the new PWT version enforces a Node version that conflicts with the repo's .nvmrc / CI image, that constraint should be documented (e.g. a brief note in the patch file or a follow-up ticket) so it is not accidentally re-enabled or left indefinitely. If the intent is to remove this permanently, consider opening an upstream issue.

Positives

• Old patch hunks (silenceDeprecations, collectCoverage comment-out) that were previously workarounds are now cleanly removed — the new PWT version apparently resolves those issues upstream, which is the right outcome.
• The SCSS fix replacing calc-size(auto, size) with height: auto is correct: calc-size() has very limited browser support and removing it avoids a Sass deprecation warning in newer sass 1.100.
• Security overrides that are no longer needed (decode-uri-component, json5, loader-utils, minimatch) are cleaned up rather than left to rot — good hygiene.
• Snapshot header URL updates (goo.gl → jestjs.io) confirm tests were actually re-run against the new jest 30 toolchain, not just rebased.