Remove the custom dependency checker in favor of Knip and syncpack by filipsobol · Pull Request #1443 · ckeditor/ckeditor5-dev

filipsobol · 2026-07-21T12:26:09Z

🚀 Summary

Removes the deprecated @ckeditor/ckeditor5-dev-dependency-checker package and uses maintained external tools directly: Knip checks unused and missing dependencies, while syncpack checks dependency versions and keeps the existing --fix workflow. Self-imports are covered by the ckeditor5-rules/no-scoped-imports-within-package ESLint rule. A major-breaking changelog entry is included for consumers of the removed package.

📌 Related issues

See https://github.com/ckeditor/ckeditor5-internal/issues/4689

💡 Additional information

Research and accepted tradeoffs are documented in the original spike: https://github.com/ckeditor/ckeditor5-internal/issues/4564
cleanuppackages() continues to strip depcheckIgnore for repositories that have not migrated yet.
Published versions of the removed package remain available on npm; no new releases will ship after this merges.
Companion implementation PR: https://github.com/ckeditor/ckeditor5-commercial/pull/11108

…nfiguration.

pomek · 2026-07-21T13:34:06Z

Summary

The migration addresses the linked issue and recognizes literal dynamic imports, but it does not preserve several existing validation guarantees. Package-local development dependencies, missing relative CSS imports, and self-imports can now pass validation. The version checker also cannot launch on Windows.

Changes

Blocker → Enforce package-local development dependencies. The non-production command in package.json:55 allows Knip to resolve dependencies from the root manifest, while the strict pass excludes tests. Removing vitest from packages/ckeditor5-dev-ci/package.json still passed check-dependencies. Validate development imports against each workspace’s own manifest.
Blocker → Restore the custom CSS and self-import checks. With the configuration at knip.ts:59-85, both a missing relative CSS import and an import from a package into itself passed check-dependencies. Preserve these explicit contracts with separate validation or an equivalent Knip integration.
Important → Launch Syncpack portably. scripts/ci/check-dependencies-versions-match.mjs:19-20 directly spawns the extensionless POSIX shim. Windows requires the .cmd launcher or invoking Syncpack’s JavaScript entry point through process.execPath.
Important → Add behavioral regression tests. Clean-tree execution only proves the current manifests pass. Add mutation-based or fixture tests covering missing production and development dependencies, dynamic imports, CSS imports, self-imports, misplaced dependencies, and --fix.

Notes

Local baseline checks passed: dependency validation, version validation, typecheck, targeted lint, and script tests. CircleCI validation and release preparation were still pending at review time.

…tably.

…ace.

…check-with-knip

…on tests, so the checks are portable across platforms.

… the layout of the other repositories.

…check-with-knip

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 11cd75e. Configure here.}

Remove the depcheck-based dependency checker in favor of Knip.

c628d2b