Remove the depcheck-based dependency checker in favor of Knip

[filipsobol]

🚀 Summary

Removed the @ckeditor/ckeditor5-dev-dependency-checker package. It was built on top of the deprecated and archived depcheck library, whose own README recommends knip as the modern replacement. This repository now uses external tools directly: Knip (check-dependencies — unused, missing, and misplaced dependencies; now also executed on CI) and syncpack (check-versions-match — version consistency, keeping the same CLI contract including --fix). Self-imports are covered by the ckeditor5-rules/no-scoped-imports-within-package ESLint rule. A major-breaking changelog entry is included, as consumers of the removed package need to migrate to knip.

📌 Related issues

See: https://github.com/ckeditor/ckeditor5-internal/issues/4564

💡 Additional information

• The full list of what the tools cover out of the box and the accepted tradeoffs is maintained in the issue above (internal).
• The old checker was already failing in this repository (7 packages) without being noticed, because check-dependencies was not part of CI. It is now.
• cleanuppackages() in release tools still strips the depcheckIgnore field from published package.json files, because repositories that have not migrated yet may carry it.
• Dependency issues surfaced by the new tooling are fixed in this PR: unused upath (web-crawler), @types/css (build-tools), and semver (root) removed; unlisted @ckeditor/ckeditor5-dev-changelog added (its binary is used by the nice script).
• Published versions of the removed package remain available on npm; no new releases will ship after this merges.

[pomek]

Summary

The migration addresses the linked issue and recognizes literal dynamic imports, but it does not preserve several existing validation guarantees. Package-local development dependencies, missing relative CSS imports, and self-imports can now pass validation. The version checker also cannot launch on Windows.

Changes

• Blocker → Enforce package-local development dependencies. The non-production command in package.json:55 allows Knip to resolve dependencies from the root manifest, while the strict pass excludes tests. Removing vitest from packages/ckeditor5-dev-ci/package.json still passed check-dependencies. Validate development imports against each workspace’s own manifest.
• Blocker → Restore the custom CSS and self-import checks. With the configuration at knip.ts:59-85, both a missing relative CSS import and an import from a package into itself passed check-dependencies. Preserve these explicit contracts with separate validation or an equivalent Knip integration.
• Important → Launch Syncpack portably. scripts/ci/check-dependencies-versions-match.mjs:19-20 directly spawns the extensionless POSIX shim. Windows requires the .cmd launcher or invoking Syncpack’s JavaScript entry point through process.execPath.
• Important → Add behavioral regression tests. Clean-tree execution only proves the current manifests pass. Add mutation-based or fixture tests covering missing production and development dependencies, dynamic imports, CSS imports, self-imports, misplaced dependencies, and --fix.

Notes

Local baseline checks passed: dependency validation, version validation, typecheck, targeted lint, and script tests. CircleCI validation and release preparation were still pending at review time.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 396253f. Configure here.}