fix(deps): remove unused depcheck to unblock js-yaml security update

[DeepDiver1975]

Problem

The Dependabot security update job for js-yaml fails with security_update_not_possible:

security_update_not_possible: js-yaml
  latest-resolvable-version: 3.14.2
  lowest-non-vulnerable-version: 4.2.0
  conflicting-dependency: depcheck@1.4.7 requires js-yaml@^3.14.1

The js-yaml advisory (prototype pollution in the merge << operator) is only fixed in 4.2.0. We already depend on js-yaml@^4.2.0 directly, but depcheck drags a second, transitive, vulnerable js-yaml 3.x into the tree:

• depcheck@1.4.7 is its latest release and hard-pins js-yaml@^3.14.1.
• It still calls jsYaml.safeLoad(...), an API removed in js-yaml 4, so it cannot be moved to 4.x.
• Dependabot's only "fix" would be downgrading depcheck to 0.4.7, which it refuses.

Why removing it is safe

depcheck appears only in package.json — it is never require()d anywhere in gulpfile.js or tasks/, and no npm script (lint, preview, bundle) invokes it. It's a CLI auditing tool meant to be run on demand (npx depcheck), not a runtime/build dependency.

Change

• Remove depcheck from dependencies.
• Regenerate package-lock.json (prunes the whole depcheck subtree).

After the change the only js-yaml in the lockfile is the direct devDependency at 4.2.0 — no 3.x remains. No functional change to the build.

If depcheck's auditing is wanted in future, run it ad-hoc with npx depcheck.

🤖 Generated with Claude Code