chore(router): trim dependencies by inlining small single-use helpers

[gioboa]

What

Several dependencies of @qwik.dev/router are used for a single function call. This PR replaces those with ~170 lines of tested, vendored code and removes dead dev-dependencies. It also bumps magic-string to the maintained v1 line.

Result: router goes from 26 → 17 direct dependencies. Every app installs 12 fewer packages and ~3MB less node_modules. No behavior changes, no client-bundle impact.

How

Each removed dependency was used for one small thing. Every vendored helper carries a // Minimal inlined replacement for \`` banner so future changes can be checked against the original package's behavior:

Removed	Was used for	Replaced by
marked (932KB)	parsing menu.md	remark-parse, already installed via @mdx-js/mdx
@azure/functions (472KB)	3 type imports	minimal vendored types (same public API shape)
github-slugger	heading anchor ids	slugger.ts (~20 lines + tests)
estree-util-value-to-estree	frontmatter → ESTree	value-to-estree.ts (~50 lines + tests)
set-cookie-parser	one parseString call	parse-set-cookie.ts (~50 lines + tests)
hast-util-to-string, hast-util-heading-rank	text/heading helpers	hast-utils.ts (~20 lines)
kleur	5 color functions in SSG logs	ansi-colors.ts (same NO_COLOR/TTY detection)
@types/mdx, mdast-util-mdx	unused / type-only	removed / moved to devDependencies

magic-string stays (per review) and is updated 0.30.21 → 1.2.3 across the workspace — v1 is the maintained line; its only breaking change is pure ESM, which matches how it's consumed here.

Dev-dependency cleanup: dropped uvu (asserts migrated to vitest), tsm (unused), @types/refractor (empty stub), @types/set-cookie-parser.

Verification

• ✅ All router and qwik-vite unit tests pass, including 3 new suites for the vendored helpers
• ✅ mdx, menu, ssg-snapshot, and resume e2e pass against a production build.core — SSG HTML output is byte-identical and apps resume correctly, so heading ids, menus, cookies, and manifest injection behave exactly as before
• ✅ tsc.check clean, api.update regenerated, lib build clean, lint.syncpack clean

Kept on purpose

source-map, unified, vfile, unist-util-visit are directly imported but already installed via @mdx-js/mdx — removing them saves nothing and creates phantom deps. magic-string, mlly, yaml, csstype, launch-editor, and the remaining deps are real features, public-API types, or not worth the correctness risk.

Bigger wins (zod+valibot ~4.2MB, refractor+svgo ~4.5MB as optional peers) are possible but breaking — left for a separate discussion.

[changeset-bot]

🦋 Changeset detected

Latest commit: 766741d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 7 packages

Name	Type
@qwik.dev/router	Patch
@qwik.dev/core	Patch
eslint-plugin-qwik	Patch
@qwik.dev/devtools	Patch
@qwik.dev/react	Patch
@qwik.dev/utils	Patch
create-qwik	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@qwik.dev/core

npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/core@8975

@qwik.dev/router

npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/router@8975

@qwik.dev/utils

npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/utils@8975

eslint-plugin-qwik

npm i https://pkg.pr.new/QwikDev/qwik/eslint-plugin-qwik@8975

create-qwik

npm i https://pkg.pr.new/QwikDev/qwik/create-qwik@8975

@qwik.dev/optimizer

npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/optimizer@8975

@qwik.dev/devtools

npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/devtools@8975

commit: 766741d

[maiieul]

Hmmm this looks good. Thanks @gioboa! Will make maintaining deps easier for sure 👍 Can you add a small comment on each vendor helper that says which vendor it was copied from? This way it reduces the likelihood for a future PR, especially with AI, to introduce a bug into those.

[gioboa]

Good idea @maiieul 👍

[maiieul]

magic-string impl says "minimal replacement". Copied source code is good but half baked AI impl is risky. Let's remove it please.

[gioboa]

Fair enough 👍 Reverted the custom literal-replace helper — magic-string is back for the manifest injection, bumped to the maintained v1 line (1.2.3, pure-ESM only, no API change). PR description updated accordingly; the rest of the vendored helpers stay as reviewed.