chore: replace depcheck with knip

[cryptodev-2s]

Core dropped depcheck for knip, so match it. Sits below the Node bump so it lands with the rest of the tooling alignment.

	Before	After
dependency linter	depcheck@^1.4.7 + .depcheckrc.json	knip@^6.23.0 + knip.config.mts

Scripts follow core's shape: lint:dependencies bakes in yarn dedupe --check, with a separate lint:dependencies:fix for the writing form, rather than threading --check through from lint.

Config is nine lines, not core's 292

Core's knip.config.mts is almost entirely per-workspace tuning for a monorepo. This is a single package, so it needs an entry pair and two ignores:

entry: ['src/index.ts', 'src/node.ts'],
project: ['src/**/*.ts'],
ignoreDependencies: ['@lavamoat/allow-scripts', '@lavamoat/preinstall-always-fail'],

Both lavamoat packages are wired in through the Yarn plugin and the lavamoat.allowScripts field rather than imported, so knip can't see the usage.

It found dead weight depcheck was hiding

The old .depcheckrc.json ignore list included ts-node. Nothing references it: it isn't a peer of ts-jest, appears nowhere outside its own package.json entry, and core doesn't carry it. Removed rather than re-ignored.

Node requirement

knip needs ^20.19.0 || >=22.12.0. Only the Lint job runs it and that job is pinned to 22.x, so this is safe ahead of the Node floor bump in the next PR.

---

Note

Low Risk
Tooling-only change to dev dependency lint; no runtime or library API changes.

Overview
Aligns dependency linting with MetaMask core by replacing depcheck and .depcheckrc.json with knip and a small knip.config.mts. Entries are src/index.ts and src/node.ts; Lavamoat packages stay on ignoreDependencies because they are wired via Yarn/Lavamoat config, not imports.

Lint scripts now run knip --config knip.config.mts --dependencies plus yarn dedupe --check under lint:dependencies, with lint:dependencies:fix for the writable dedupe path used from lint:fix. The top-level lint script no longer passes --check into the dependencies step separately.

ts-node is removed from devDependencies (nothing in the repo referenced it; it had only been masked by depcheck ignores). Lockfile churn reflects dropping depcheck’s dependency tree and adding knip’s (oxc-parser/resolver, etc.).

^{Reviewed by Cursor Bugbot for commit aabee68. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	knip@​6.34.0

View full report

[socket-security]

Warning

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Environment variable access: npm package-manager-detector reads npm_config_user_agent Env Vars: npm_config_user_agent Location: Package overview From: package.json → npm/knip@6.34.0 → npm/package-manager-detector@1.8.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/package-manager-detector@1.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm yaml is 68.0% likely to have a medium risk anomaly Notes: The code presents a standard, non-malicious NodeBase component used in YAML/JS conversion. The primary risk surface is the optional reviver and onAnchor callbacks provided by the user: if untrusted, these can execute arbitrary code or influence the transformed representation via applyReviver or the reviver itself. This is expected behavior for extensible YAML libraries; ensure callbacks come from trusted sources and sandbox or validate revivers where possible. Confidence: 0.68 Severity: 0.60 From: package.json → npm/knip@6.34.0 → npm/yaml@2.9.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yaml@2.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm zod is 98.0% likely to have a medium risk anomaly Notes: The code is a readable dynamic JavaScript code generator. Its primary security concern is intentional use of new Function with caller-controlled source components, creating arbitrary code execution if untrusted data is supplied to write, args, or object keys in closed. In the expected trusted code-generation context this is likely legitimate and there is no evidence of malware or supply-chain backdoor behavior. The callback double invocation and lack of exception-safe indentation restoration are behavioral concerns rather than evidence of malicious intent. Confidence: 0.98 Severity: 0.62 From: package.json → npm/knip@6.34.0 → npm/web3@4.16.0 → npm/zod@4.5.4 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/zod@4.5.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm zod is 98.0% likely to have a medium risk anomaly Notes: The file/package path uses a dynamic code generation/compilation path (compile) that can execute attacker-controlled JavaScript through the Function constructor when fed untrusted inputs or arguments, potentially enabling arbitrary code execution. Unsafe dynamic code generation with untrusted data or content can lead to remote code execution if inputs are not properly validated or sandboxed. Confidence: 0.98 Severity: 0.68 From: package.json → npm/knip@6.34.0 → npm/web3@4.16.0 → npm/zod@4.5.4 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/zod@4.5.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm zod is 98.0% likely to have a medium risk anomaly Notes: The module uses the Function constructor to generate and execute code at runtime, making it unsafe when content, argument names, or closed-object keys can be influenced by untrusted input. It constitutes a risk of arbitrary code execution if inputs are attacker-controlled, and should be used only with trusted inputs or replaced with a constrained interpretation or templating mechanism. Confidence: 0.98 Severity: 0.72 From: package.json → npm/knip@6.34.0 → npm/web3@4.16.0 → npm/zod@4.5.4 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/zod@4.5.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Ignoring alerts on:

• @oxc-resolver/binding-wasm32-wasi@11.24.2
• formatly@0.7.0
• jiti@2.7.0
• knip@6.34.0
• oxc-parser@0.147.0
• oxc-resolver@11.24.2
• @emnapi/core@1.11.2

View full report

The merge-base changed after approval.

[cryptodev-2s]

@SocketSecurity ignore npm/@emnapi/core@1.11.2
@SocketSecurity ignore npm/@oxc-resolver/binding-wasm32-wasi@11.24.2
@SocketSecurity ignore npm/eslint@9.39.5
@SocketSecurity ignore npm/formatly@0.7.0
@SocketSecurity ignore npm/jiti@2.7.0
@SocketSecurity ignore npm/knip@6.34.0
@SocketSecurity ignore npm/oxc-parser@0.147.0
@SocketSecurity ignore npm/oxc-resolver@11.24.2