🏗️🔧：drop gulp-sourcemaps for gulp's own sourcemap support

[DerekNonGeneric]

gulp-sourcemaps has had no release since November 2020, and it is the only thing still pulling postcss 7 into the tree:

$ pnpm why postcss
postcss@7.0.39
└─┬ @gulp-sourcemaps/identity-map@2.0.1
  └─┬ gulp-sourcemaps@3.0.0
    └── @openinf/portal (devDependencies)

postcss 7 is end-of-life, so the five advisories filed against it — four of them high — cannot be resolved by upgrading. Our own postcss is 8.5.26 and was never affected; the alerts persist purely because this one abandoned package drags v7 along behind it.

gulp has accepted sourcemaps options on src and dest since v4, which is all this task was using gulp-sourcemaps for.

It also fixes the sourcemap, which has never worked

sourcemaps.write() ran before gulp-rename, so the rename rewrote the map's extension along with the stylesheet's:

	on disk	stylesheet asks for
before	maps/main.css.min.css	maps/main.css.map ❌
after	maps/main.min.css.map	maps/main.min.css.map ✅

The file was a perfectly valid source map the whole time — just written under a name nothing referenced, so devtools got a 404. Writing it through dest after the rename lines the two up.

$ python3 -c "import json; m=json.load(open('_site/assets/styles/maps/main.min.css.map')); print(m['version'], len(m['sources']), m['file'])"
3 43 main.min.css

Verification

Emitted CSS is unchanged. Built both revisions and diffed, ignoring the sourceMappingURL comment:

dev  main.css      IDENTICAL
prod main.min.css  IDENTICAL   (133125 → 133128 bytes; the map filename is 3 chars longer)

nps build, nps test, and nps format.all all pass, with format.all leaving the tree clean.

After the change the lockfile contains no reference to postcss@7 or gulp-sourcemaps, and the build still succeeds with the orphaned store directories deleted — so nothing was quietly depending on them.

What this does not fix

The remaining two alerts are immutable@3.8.3, reached through browser-sync. Browser-sync is current (2025-04), so that one needs either an upstream fix or a different dev server; it is dev-only and out of scope here.

Part of working through #254 — though most of that list is release-inactivity noise rather than risk. This was the entry where an abandoned package and an unfixable advisory were the same problem.

List of any relevant issue numbers: #254

[netlify]

✅ Deploy Preview for gh-pages-openinf ready!

Name	Link
🔨 Latest commit	1c4833b
🔍 Latest deploy log	https://app.netlify.com/projects/gh-pages-openinf/deploys/6a795f350ec3020008d0cf7e
😎 Deploy Preview	https://deploy-preview-1791--gh-pages-openinf.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.