Remove the depcheck-based dependency checker in favor of Knip

.changelog/20260721140527_ci_4564_remove_dependency_checker.md

@@ -0,0 +1,6 @@
+---
+type: Major breaking change
+scope:
+---
+
+Removed the `@ckeditor/ckeditor5-dev-dependency-checker` package. It was built on top of the deprecated `depcheck` library. Use [`knip`](https://knip.dev/) to validate dependencies instead.

.circleci/template.yml

@@ -108,6 +108,9 @@ jobs:
       - run:
           name: Validate versions of dependencies
           command: pnpm run check-versions-match
+      - run:
+          name: Validate dependencies
+          command: pnpm run check-dependencies
       - run:
           name: Type check the project
           command: pnpm run typecheck

.syncpackrc.mjs

@@ -0,0 +1,35 @@
+/**
+ * @license Copyright (c) 2003-2026, CKSource Holding sp. z o.o. All rights reserved.
+ * For licensing, see LICENSE.md.
+ */
+
+/**
+ * Configuration for `syncpack`, which ensures that `dependencies` and `devDependencies`
+ * across the repository use consistent versions. Executed in CI via the
+ * `check-versions-match` script. Run it with the `--fix` argument to resolve reported
+ * issues automatically.
+ *
+ * Unlike in the `ckeditor5` repository, version ranges (the `^` operator) are allowed here.
+ * When the same dependency is declared with different versions, the highest one wins.
+ */
+export default {
+	source: [
+		'package.json',
+		'packages/*/package.json'
+	],
+
+	versionGroups: [
+		{
+			label: 'Packages developed in this repository must use the workspace protocol.',
+			dependencies: [ '$LOCAL' ],
+			pinVersion: 'workspace:*'
+		}
+	],
+
+	semverGroups: [
+		{
+			dependencies: [ '$LOCAL' ],
+			isIgnored: true
+		}
+	]
+};

README.md

@@ -14,7 +14,6 @@ This repository is a monorepo. It contains multiple npm packages.
 | [`@ckeditor/ckeditor5-dev-bump-year`](/packages/ckeditor5-dev-bump-year)                     | [![npm version](https://badge.fury.io/js/%40ckeditor%2Fckeditor5-dev-bump-year.svg)](https://www.npmjs.com/package/@ckeditor/ckeditor5-dev-bump-year)                       |
 | [`@ckeditor/ckeditor5-dev-changelog`](/packages/ckeditor5-dev-changelog)                     | [![npm version](https://badge.fury.io/js/%40ckeditor%2Fckeditor5-dev-changelog.svg)](https://www.npmjs.com/package/@ckeditor/ckeditor5-dev-changelog)                       |
 | [`@ckeditor/ckeditor5-dev-ci`](/packages/ckeditor5-dev-ci)                                   | [![npm version](https://badge.fury.io/js/%40ckeditor%2Fckeditor5-dev-ci.svg)](https://www.npmjs.com/package/@ckeditor/ckeditor5-dev-ci)                                     |
-| [`@ckeditor/ckeditor5-dev-dependency-checker`](/packages/ckeditor5-dev-dependency-checker)   | [![npm version](https://badge.fury.io/js/%40ckeditor%2Fckeditor5-dev-dependency-checker.svg)](https://www.npmjs.com/package/@ckeditor/ckeditor5-dev-dependency-checker)     |
 | [`@ckeditor/ckeditor5-dev-docs`](/packages/ckeditor5-dev-docs)                               | [![npm version](https://badge.fury.io/js/%40ckeditor%2Fckeditor5-dev-docs.svg)](https://www.npmjs.com/package/@ckeditor/ckeditor5-dev-docs)                                 |
 | [`@ckeditor/ckeditor5-dev-license-checker`](/packages/ckeditor5-dev-license-checker)         | [![npm version](https://badge.fury.io/js/%40ckeditor%2Fckeditor5-dev-license-checker.svg)](https://www.npmjs.com/package/@ckeditor/ckeditor5-dev-license-checker)           |
 | [`@ckeditor/ckeditor5-dev-manual-server`](/packages/ckeditor5-dev-manual-server)             | [![npm version](https://badge.fury.io/js/%40ckeditor%2Fckeditor5-dev-manual-server.svg)](https://www.npmjs.com/package/@ckeditor/ckeditor5-dev-manual-server)               |

knip.ts

@@ -0,0 +1,89 @@
+/**
+ * @license Copyright (c) 2003-2026, CKSource Holding sp. z o.o. All rights reserved.
+ * For licensing, see LICENSE.md.
+ */
+
+import type { KnipConfig } from 'knip';
+
+/**
+ * Configuration for the dependency checks (`pnpm run check-dependencies`), executed as:
+ *
+ *   knip --dependencies                        (unused and unlisted packages)
+ *   knip --dependencies --production --strict  (misplaced `dependencies` vs `devDependencies`)
+ *
+ * Patterns marked with the `!` suffix describe production code. They must match the folders
+ * that end up in the published packages (`lib`, `src`, `bin`, `theme`).
+ */
+
+/**
+ * Common configuration for the `packages/*` workspaces. Knip supports workspace configuration
+ * only in the root config and a specific workspace entry does not merge with the `packages/*`
+ * one, so single-package overrides go through this helper instead of repeating the patterns.
+ */
+const packageWorkspace = ( ignoreDependencies: Array<string> = [] ) => ( {
+	// Test fixtures reference intentionally non-existent packages.
+	ignore: [ 'tests/**/fixtures/**' ],
+	entry: [
+		'lib/**/*.{js,mjs,cjs}!',
+		'src/**/*.{js,mjs,cjs,ts}!',
+		'bin/**/*.{js,mjs,cjs}!',
+		'theme/**/*.{js,mjs,cjs,ts}!',
+		'theme/**/*.css!',
+		'tests/**/*.{js,mjs,cjs,ts}',
+		'scripts/**/*.{js,mjs,cjs,ts}'
+	],
+	project: [
+		'lib/**/*.{js,mjs,cjs}!',
+		'src/**/*.{js,mjs,cjs,ts}!',
+		'bin/**/*.{js,mjs,cjs}!',
+		'theme/**/*.{js,mjs,cjs,ts}!',
+		'theme/**/*.css!',
+		'tests/**/*.{js,mjs,cjs,ts}',
+		'scripts/**/*.{js,mjs,cjs,ts}'
+	],
+	ignoreDependencies
+} );
+
+/**
+ * Type packages imported by production code live in `dependencies`, because type-only imports
+ * that are part of a package's public API must resolve in consumer projects, for example under
+ * Yarn PnP. See https://github.com/ckeditor/ckeditor5/issues/17213.
+ *
+ * Knip expects the opposite (type-only imports in `devDependencies`) and its strict production
+ * mode would report such packages as unused, so they are ignored there (the `!` suffix scopes
+ * the ignore to production mode). See https://github.com/webpro-nl/knip/issues/248.
+ */
+const typeDependencyWorkspace = ( ignoreDependencies: Array<string> ) =>
+	packageWorkspace( ignoreDependencies.map( dependency => `${ dependency }!` ) );
+
+const config: KnipConfig = {
+	compilers: {
+		// Extracts `@import` statements from plain CSS files, so packages imported in `theme/`
+		// participate in the dependency checks. See https://knip.dev/features/compilers.
+		css: ( text: string ) => [ ...text.matchAll( /(?<=@)import[^;]+/g ) ].join( '\n' )
+	},
+
+	workspaces: {
+		'.': {
+			entry: [ 'scripts/**/*.{js,mjs,cjs}', 'scripts-tests/**/*.{js,mjs}', '*.{js,mjs,ts}' ],
+			project: [ 'scripts/**/*.{js,mjs,cjs}', 'scripts-tests/**/*.{js,mjs}', '*.{js,mjs,ts}' ],
+			ignoreDependencies: [
+				// Spawned via an explicit `node_modules/.bin` path in
+				// `scripts/ci/check-dependencies-versions-match.mjs`, invisible to static analysis.
+				'syncpack'
+			]
+		},
+		'packages/ckeditor5-dev-manual-server': packageWorkspace( [
+			// The package exports Vite plugins and imports `vite` only in type positions,
+			// but it deliberately ships `vite` as a runtime dependency for its consumers,
+			// which run the manual test server.
+			'vite'
+		] ),
+		'packages/ckeditor5-dev-build-tools': typeDependencyWorkspace( [ 'type-fest' ] ),
+		'packages/ckeditor5-dev-changelog': typeDependencyWorkspace( [ '@types/semver' ] ),
+		'packages/ckeditor5-dev-utils': typeDependencyWorkspace( [ '@types/pacote' ] ),
+		'packages/*': packageWorkspace()
+	}
+};
+
+export default config;

package.json

@@ -16,6 +16,7 @@
   },
   "type": "module",
   "devDependencies": {
+    "@ckeditor/ckeditor5-dev-changelog": "workspace:*",
     "@inquirer/prompts": "^7.10.1",
     "@listr2/prompt-adapter-inquirer": "^2.0.22",
     "@vitest/coverage-v8": "^4.1.2",
@@ -27,10 +28,11 @@
     "globals": "^16.5.0",
     "husky": "^9.1.7",
     "js-yaml": "^4.2.0",
+    "knip": "^6.27.0",
     "lint-staged": "^16.4.0",
     "listr2": "^8.3.3",
     "minimist": "^1.2.8",
-    "semver": "^7.7.4",
+    "syncpack": "^15.3.2",
     "typescript": "5.5.4",
     "upath": "^2.0.1",
     "vite": "^8.1.0",
@@ -50,7 +52,7 @@
     "typecheck": "tsc",
     "precommit": "lint-staged",
     "reinstall": "pnpx rimraf --glob \"**/node_modules\" && pnpm install",
-    "check-dependencies": "ckeditor5-dev-dependency-checker"
+    "check-dependencies": "knip --dependencies --no-config-hints && knip --dependencies --production --strict --no-config-hints"
   },
   "lint-staged": {
     "**/*": [

packages/ckeditor5-dev-build-tools/package.json

@@ -37,13 +37,12 @@
     "purgecss": "^8.0.0",
     "rolldown": "^1.1.2",
     "source-map": "^0.7.6",
+    "type-fest": "^4.41.0",
     "upath": "^2.0.1"
   },
   "devDependencies": {
-    "@types/css": "^0.0.38",
     "@types/node": "^22.19.17",
     "@vitest/coverage-v8": "^4.1.2",
-    "type-fest": "^4.41.0",
     "vitest": "^4.1.2"
   },
   "scripts": {
@@ -52,9 +51,5 @@
     "test": "vitest run --config vitest.config.ts",
     "coverage": "vitest run --config vitest.config.ts --coverage",
     "test:dev": "vitest dev"
-  },
-  "depcheckIgnore": [
-    "@types/css",
-    "@vitest/coverage-v8"
-  ]
+  }
 }

packages/ckeditor5-dev-changelog/package.json

@@ -30,6 +30,7 @@
   "dependencies": {
     "@11ty/gray-matter": "^2.1.0",
     "@ckeditor/ckeditor5-dev-utils": "workspace:*",
+    "@types/semver": "^7.7.1",
     "cac": "^7.0.0",
     "date-fns": "^4.1.0",
     "glob": "^13.0.6",
@@ -38,7 +39,6 @@
     "upath": "^2.0.1"
   },
   "devDependencies": {
-    "@types/semver": "^7.7.1",
     "@vitest/coverage-v8": "^4.1.2",
     "rolldown": "^1.1.2",
     "vitest": "^4.1.2"
@@ -49,9 +49,5 @@
     "test": "vitest run --config vitest.config.ts",
     "coverage": "vitest run --config vitest.config.ts --coverage",
     "test:dev": "vitest dev"
-  },
-  "depcheckIgnore": [
-    "@vitest/coverage-v8",
-    "typescript"
-  ]
+  }
 }