chore(deps): remove runtime dependencies nothing imports, and unblock Dependabot's safe updates

.changeset/lucky-pugs-invent.md

@@ -0,0 +1,24 @@
+---
+"@workspacejson/rules": patch
+"@workspacejson/spec": patch
+---
+
+Remove runtime dependencies that were declared but never imported.
+
+`@workspacejson/rules` declared `dedent`, `ignore`, `unified` and `zod` in
+`dependencies`. None of them is imported anywhere in the package. `zod` and
+`unified` appeared only as string literals in the framework-detection tables —
+the parser looks for the *word* "zod" in a manifest, it never loads the library.
+
+Because these were `dependencies` rather than `devDependencies`, every consumer
+installed all four to run code that does not exist. Removing them changes no
+behavior: the full suite passes unchanged.
+
+`@workspacejson/spec` drops the unused `json-schema-to-typescript`
+devDependency along with `scripts/generate-types.js`, which read the schema file
+and discarded it. `src/types.ts` is hand-written and committed; nothing was ever
+generated. The build script is now `tsc`.
+
+A new `unused-dependency` guard in `scripts/check-architecture.mjs` fails the
+build if a declared runtime dependency is never imported, so this cannot
+silently return.

.github/dependabot.yml

@@ -17,9 +17,20 @@ updates:
       include: scope
     groups:
       # Type definitions and build tooling churn constantly and carry no runtime
-      # risk. Grouping them keeps the review queue readable.
+      # risk at the patch/minor level. Grouping them keeps the review queue
+      # readable.
+      #
+      # Majors are excluded from the group deliberately. The first run of this
+      # config bundled a harmless `@types/node` patch with `typescript` 5 -> 7
+      # and `vitest` 1 -> 4, and the whole group failed on `error TS5102:
+      # Option 'baseUrl' has been removed`. One safe update was held hostage by
+      # two ecosystem migrations. Majors now arrive as individual pull requests
+      # that can be scheduled as the real work they are.
       dev-tooling:
         dependency-type: development
+        update-types:
+          - minor
+          - patch
         patterns:
           - "@types/*"
           - typescript
@@ -38,6 +49,19 @@ updates:
       # packages do not claim to support.
       - dependency-name: "@types/node"
         update-types: [version-update:semver-major]
+      # A TypeScript major is a migration, not an update: TypeScript 7 removes
+      # compiler options this repository's tsconfig still sets. It emits the
+      # declarations that `@workspacejson/rules` typechecks against and that
+      # consumers install, so it is upgraded deliberately, with the tsconfig
+      # changes in the same pull request.
+      - dependency-name: typescript
+        update-types: [version-update:semver-major]
+      # vitest 1 -> 4 crosses three majors, and `@workspacejson/rules` re-exports
+      # vitest helpers through its published `./testing` entry point — so a
+      # vitest major is a public-surface change for consumers writing rule tests,
+      # not an internal test-runner bump.
+      - dependency-name: vitest
+        update-types: [version-update:semver-major]
 
   - package-ecosystem: github-actions
     directory: /

packages/rules/package.json

@@ -62,14 +62,10 @@
   "dependencies": {
     "@workspacejson/spec": "workspace:*",
     "ajv": "^8.16.0",
-    "dedent": "^1.5.3",
     "fast-glob": "^3.3.2",
-    "ignore": "^5.3.1",
     "remark": "^15.0.0",
     "remark-parse": "^11.0.0",
-    "simple-git": "^3.25.0",
-    "unified": "^11.0.0",
-    "zod": "^3.23.0"
+    "simple-git": "^3.25.0"
   },
   "devDependencies": {
     "@types/node": "22.19.17",

packages/spec/package.json

@@ -55,7 +55,7 @@
     "CHANGELOG.md"
   ],
   "scripts": {
-    "build": "tsc && node scripts/generate-types.js",
+    "build": "tsc",
     "test": "npm run build && vitest run",
     "typecheck": "tsc --noEmit",
     "prepublishOnly": "pnpm build && pnpm test && node ../../scripts/verify-package-tarball.mjs"
@@ -65,7 +65,6 @@
   },
   "devDependencies": {
     "@types/node": "22.19.17",
-    "json-schema-to-typescript": "^14.0.0",
     "typescript": "^5.4.0",
     "vitest": "^1.6.0"
   }