SUPPLY-001A — Remove unused gpxparser dependency chain #127

Officer impact: No member or officer workflow changes. Removing an unused website dependency reduces the build's attack surface; officers should see the same pages and navigation.

Officer documentation: None — this is a dependency/lockfile cleanup with no public content, navigation, collected data, permissions, account, payment, deployment, or officer-duty change.

Deployment evidence: PR #130 merged as exact main commit 91f834dc7e33eb36b34f520544f9fd7d00810d8e. Pull-request and post-merge CI passed. The GitHub Pages job rebuilt the same artifact and correctly found nothing new to commit. Netlify production deploy 6a54a055f0b97c000829980a is ready for that exact commit, and its immutable URL matches the HTTP-200 runmprc.com response. Firebase explicitly skipped because FIREBASE_SERVICE_ACCOUNT is absent; outside providers were unchanged.

Problem

The root project declares gpxparser, but repository search finds no source import or runtime use. Version 3.0.8 pulls obsolete jsdom@15, request, form-data, and related packages. The current production audit attributes critical and other advisories to that otherwise unused chain.

Atomic outcome

Remove only the unused direct gpxparser dependency and the lockfile entries that become unreachable. Prove that application output and tested behavior do not change.

Invariants

• No application source, route, callback, member, payment, Firebase, Functions, Rules, provider, deploy workflow, or public asset changes.
• Do not replace gpxparser with another dependency.
• Do not run or apply npm audit fix, forced upgrades, or unrelated lockfile refreshes.
• The clean lockfile install remains reproducible on Node 20.
• The production bundle hashes remain identical before and after removal on the same base commit.

Scope

• package.json
• package-lock.json
• Minimum exact-status updates in SECURITY.md, GITHUB_ISSUES.md, and GITHUB_ISSUE_SLICES.md after overlapping SAFETY-001 — Preserve callbacks and fail closed on local Firebase isolation #99 documentation ownership is released
• Live issue/tracker evidence

Acceptance criteria

• rg proves no use outside dependency/tracking records before removal.
• A Node 20 lockfile-only removal deletes gpxparser and only newly unreachable transitive packages.
• Fresh npm ci --legacy-peer-deps succeeds.
• npm ls gpxparser --all proves the package is absent.
• Before/after npm audit --omit=dev counts and removed advisory chain are recorded without forced fixes.
• Complete frontend Jest, diagnostic production build, and git diff --check pass.
• Before/after production asset hashes are identical on the same source base.
• Exact pull-request and post-merge hosted checks pass.
• GitHub Pages publication and runmprc.com response are checked without claiming an exact Netlify commit unless provider evidence exists.

Local evidence on exact base f6e86bebefd89b518af4c2123d63bdae578df0a7

• Fresh Node 20.20.2 install: 2,155 packages installed; npm ls gpxparser --all returns an empty tree.
• Lockfile: 50 package entries removed and zero added; no retained version, resolved, or integrity field changed. Shared packages only change to development-only metadata after the production chain disappears.
• Production audit: 33 to 22 total, 3 to 1 critical, 9 to 8 high, 20 to 12 moderate, and 1 to 1 low. The production dependency graph falls from 686 to 590 packages.
• Behavior: 47/47 frontend Jest tests and 10/10 standalone SPA callback/navigation tests pass.
• Build: the diagnostic optimized build passes, and all emitted asset hashes match the pre-removal baseline, including main.58ede287.js, main.cdd8bda4.css, and 962.0a706e83.chunk.js.
• Scope: only the two dependency manifests and the three claimed tracking/security documents change; git diff --check passes.

Closure evidence

• PR #130 merged at 2026-07-13T08:22:43Z as 91f834dc7e33eb36b34f520544f9fd7d00810d8e after two independent exact-head approvals.
• Pull-request run 29235020205 and post-merge run 29235228183 passed frontend, Functions, and Rules. Both named frontend Jest steps passed 47/47; the standalone SPA suite passed 10/10 locally because its hosted step remains separately tracked by CI-001B1A — Run SPA callback safety tests in hosted CI #126.
• Deploy run 29235228098 passed the GitHub Pages build/publish job. The generated artifact was byte-identical to the already published branch, so the action correctly reported nothing to commit and left gh-pages at its prior artifact commit rather than falsely stamping the source SHA.
• The same deploy run did not deploy Firebase: its log says No FIREBASE_SERVICE_ACCOUNT secret; skipping Firebase deploy. No provider configuration changed.
• Netlify production deploy 6a54a055f0b97c000829980a reports state: ready, context: production, and exact commit_ref: 91f834dc7e33eb36b34f520544f9fd7d00810d8e.
• The immutable Netlify deploy and https://runmprc.com/ both return HTTP 200, reference main.58ede287.js and main.cdd8bda4.css, and return the same index SHA-256 d0f2b5fe6aea293b2af33da8a7d31cc53f675b64d6ed1b07b00709eae9b2be73.

Dependencies and coordination

• CI-001A/CI-001A — Repair the deterministic frontend test baseline #103 is merged and closed, so the code/test dependency is complete.
• SAFETY-001 — Preserve callbacks and fail closed on local Firebase isolation #99 is merged and closed at final main f6e86bebefd89b518af4c2123d63bdae578df0a7; its overlapping dependency/documentation ownership is released, and this branch was refreshed to that exact commit before editing.
• PAY-003A — Harden Stripe webhook ingress and monotonic event reduction #101/PROMO-001 — Disable unmodeled Stripe price adjustments #102 own Stripe/Functions files and remain untouched.
• Parent tracker is SUPPLY-001 in GITHUB_ISSUES.md.

Claim protocol

Creation is not a claim. Before editing, assign this issue, add status:in-progress, post CLAIMED by <canonical agent> at <UTC>; branch <branch>, and re-read every comment. One branch and one pull request only.