chore(customs): replace deep-equal with util.isDeepStrictEqual

[vbudhram]

Because

• deep-equal is a third-party package that does what Node's util.isDeepStrictEqual already does.
• The customs server is the only package that pins it, so replacing the two call sites drops the dependency.

This pull request

• Replaces deep-equal with util.isDeepStrictEqual in limits.js and requestChecks.js.
• Removes deep-equal from packages/fxa-customs-server/package.json and updates yarn.lock.

Issue that this pull request solves

Closes: https://mozilla-hub.atlassian.net/browse/FXA-13931

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on: lib/settings/limits.js and lib/settings/requestChecks.js, four changed lines between them.
• Suggested review order: the two settings files, then package.json and yarn.lock.
• Risky or complex parts: the strict vs loose comparison. See Other information.

Screenshots (Optional)

Other information (Optional)

deep-equal compares loosely by default and isDeepStrictEqual is strict, so the case to worry about is 1 vs '1'. Two things make the swap safe:

• Both calls sit in the else if of a typeof current !== typeof future guard. A top-level 1 vs '1' takes the first branch and never reaches the comparison.
• The else if body only calls log.info. Nothing is assigned, returned, or thrown, so where strict and loose disagree the effect is one log line.

One caveat worth stating: for objects and arrays, typeof is 'object' on both sides, so a nested 1 vs '1' does reach the comparison and could log differently. Still only a log line.

Verification: test/local/settings_tests.js covers both call sites and passes locally, 30 assertions. npx nx lint fxa-customs-server is clean. No tests needed changing, which is why that box is unchecked.

[Copilot]

Pull request overview

Replaces the customs server’s third-party deep comparison utility with Node’s built-in equivalent.

Changes:

• Uses util.isDeepStrictEqual at both comparison sites.
• Removes deep-equal and its obsolete lockfile entries.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
limits.js	Uses Node’s strict deep comparison.
requestChecks.js	Uses Node’s strict deep comparison.
package.json	Removes the direct dependency.
yarn.lock	Removes obsolete dependency entries.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.