[uplift] chore: dep:check + knip audit

.ncurc.cjs

@@ -0,0 +1,6 @@
+// npm-check-updates config for `pnpm dep:check` (see CONTRIBUTING.md).
+module.exports = {
+  // Skip versions published in the last week (matches pnpm's
+  // `minimumReleaseAge` in `pnpm-workspace.yaml`).
+  cooldown: 7,
+};

CONTRIBUTING.md

@@ -50,6 +50,42 @@ pnpm only installs versions published at least 7 days ago
 included. For an urgent security fix that's newer than that, add the package to
 `minimumReleaseAgeExclude` with a comment and a date to remove it.
 
+### Updating dependencies
+
+We don't use Renovate or Dependabot version-update PRs. Instead, run this
+before each release, and when a Dependabot security alert comes in:
+
+```sh
+$ pnpm dep:check
+```
+
+It runs [npm-check-updates](https://github.com/raineorshine/npm-check-updates)
+and lists newer versions of the devDependencies and pnpm (`packageManager`). It
+doesn't change any files. Versions published in the last week are left out
+(`.ncurc.cjs`). To apply them, run `pnpm exec ncu -u` (or pick packages with
+`pnpm exec ncu -u <name> ...`), then `pnpm install` and `pnpm check`. Make the
+updates in one PR, and read the release notes of anything that runs in
+`pnpm check`. The package has no `dependencies`, so updates don't change what
+users install and need no changeset.
+
+Version ranges:
+
+- `^` by default.
+- Exact versions for tools whose upgrade needs its own PR: oxfmt and oxlint (a
+  new version can reformat the repo or fail CI), and the tools `pack:check`
+  and `types:check` rely on to compare with 3.2.2 (TypeScript, terser, publint,
+  attw).
+- Exact versions for the comparison baselines: `fast-deep-equal` (the upstream
+  version we track) and `react-fast-compare-published` (see
+  [Benchmarks](#benchmarks)).
+
+When you add or remove a tool, check that every devDependency is still used
+with [knip](https://knip.dev) (`knip.jsonc` lists what it can't see on its own):
+
+```sh
+$ pnpm dlx knip
+```
+
 **TL; DR:** － Everything you normally need to run is aggregated into:
 
 ```sh

knip.jsonc

@@ -0,0 +1,15 @@
+// knip config for the dependency audit (`pnpm dlx knip`; see CONTRIBUTING.md).
+// knip isn't a devDependency: we run it at the end of each change to tooling.
+{
+  "$schema": "https://unpkg.com/knip@6/schema.json",
+  "entry": [
+    // npm-check-updates config for `pnpm dep:check`.
+    ".ncurc.cjs",
+    // Type probe: `pack:check` compiles these against the packed tarball.
+    "test/types/*.{cts,mts,ts}",
+  ],
+  // `pack:check` runs its `attw` binary through a helper knip can't follow.
+  "ignoreDependencies": ["@arethetypeswrong/cli"],
+  // Not a Node tool; `lint:gha` skips it when it isn't installed.
+  "ignoreBinaries": ["zizmor"],
+}

package.json

@@ -14,6 +14,7 @@
     "types:check": "node scripts/types-check.mjs",
     "test": "vitest run",
     "changeset": "changeset",
+    "dep:check": "ncu",
     "pack:check": "node scripts/pack-check.mjs",
     "size": "node scripts/size.mjs",
     "bench": "vitest bench --run --project \"node (bench)\" --reporter=default --reporter=./bench/summary-reporter.mjs"
@@ -36,16 +37,17 @@
     "url": "https://github.com/FormidableLabs/react-fast-compare/issues"
   },
   "homepage": "https://github.com/FormidableLabs/react-fast-compare",
-  "packageManager": "pnpm@12.16.0",
+  "packageManager": "pnpm@12.17.0",
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.5",
     "@changesets/changelog-github": "^1.0.1",
     "@changesets/cli": "^3.0.3",
     "@types/react": "^19.3.0",
-    "@vitest/browser-playwright": "^5.0.5",
-    "@vitest/coverage-v8": "^5.0.5",
+    "@vitest/browser-playwright": "^5.1.0",
+    "@vitest/coverage-v8": "^5.1.0",
     "fast-deep-equal": "3.1.3",
     "jsdom": "^30.1.3",
+    "npm-check-updates": "^23.1.1",
     "oxfmt": "0.75.0",
     "oxlint": "1.90.0",
     "playwright": "^1.64.1",
@@ -56,7 +58,7 @@
     "react-fast-compare-published": "npm:react-fast-compare@3.2.2",
     "terser": "5.51.2",
     "typescript": "7.0.2",
-    "vitest": "^5.0.5"
+    "vitest": "^5.1.0"
   },
   "files": [
     "index.js",