[vscheuber]

npm ci prints three deprecation notices in this repository: @types/colors, inflight and glob@7.2.3. This removes the sources of all three.

What changes

• copyfiles removed. No script, workflow, source file or doc uses it. It was the only user of glob@7.2.3 and inflight@1.0.6 and pulled in 31 other packages (yargs 16, through2, noms, mkdirp, untildify and more). The lockfile loses 33 entries in all and gains none.
• @types/colors removed. It is a deprecated stub; colors@1.4.0 ships its own index.d.ts and safe.d.ts.
• colors declared as a devDependency, pinned to 1.4.0. The stub was the only thing that brought colors into the tree ("colors": "*"), and src/utils/Version.ts imports it. Removing the stub alone would have broken the build. The pin is the version that was installed, so what is bundled does not change.
• tsdown.config.ts: both names leave the neverBundle list. colors is not added to it, so it stays inlined like the other runtime packages (docs/BUILD-ENV.md, section 2.2.1).

How it was checked

The branch was redone on main after the 5.0.0-26 release: the same two npm operations on the current lockfile, not a merge of the old one.

• npm ci on the new lockfile: 499 packages (was 532), no deprecation notices. npm ls --all reports no invalid or missing package.
• The bundles are byte-identical. I built dist/ with the old and the new tsdown.config.ts (build timestamp masked) and compared every .cjs file: all 7 are identical. grep -c 'require("@' dist/*.cjs finds none.
• npm run check (0 errors; the 8 warnings are in src/app.ts, src/cli/FrodoCommand.ts and src/ops/McpServerOps.ts, files this change does not touch) and npx tsc --noEmit pass.
• Tests: the whole suite on the branch rebuilt on main 56c6dc91d (lib pin 5.0.0-43): 1,056 suites and 9,849 tests passed (10 suites and 148 tests skipped), 10,274 snapshots, exit 0, in one run. No snapshot or recording was changed.
• I did not build the native binary (npm run build:binary); the bundle comparison above stands in for it, since the binary is built from the same bundle.

Not changed

• npm audit --omit=dev is 0 before and after. The 6 low findings left are deepmerge inside jest.
• npm 12 also warns that @parcel/watcher, unrs-resolver and the library's postinstall have blocked install scripts. That needs a decision on allowScripts and is left out of this change.

🤖 Generated with Claude Code