Skip to content

fix: update deps, Node 22, OIDC release, validate#15

Merged
mhweiner merged 5 commits intomainfrom
update-deps-security
Feb 24, 2026
Merged

fix: update deps, Node 22, OIDC release, validate#15
mhweiner merged 5 commits intomainfrom
update-deps-security

Conversation

@mhweiner
Copy link
Copy Markdown
Contributor

@mhweiner mhweiner commented Feb 23, 2026

Summary

  • Dependencies: eslint 10 + flat config, kizu 4, typescript 5.6, ajv 8.18, typescript-eslint 8. Remove c8. Add validate script and --fix on lint.
  • CI: Node 22 for release and typecheck; keep matrix [18, 20, 22, 24] for PR tests.
  • Release: OIDC trusted publishing (no NPM_TOKEN). Remove NPM_CONFIG_PROVENANCE (automatic with OIDC). Use npm run validate, Node 22, npx autorel@^2 --publish.

Test plan

  • npm run validate passes
  • npm audit 0 vulnerabilities

- Upgrade eslint to v10 with flat config (eslint.config.mjs)
- Upgrade ajv to v8.18.0 (fixes ReDoS vulnerability)
- Update kizu to v4, typescript to v5.6
- Replace @typescript-eslint packages with typescript-eslint
- Remove c8 (coverage now handled by kizu)
- Add validate script and --fix to lint
@mhweiner mhweiner changed the title fix: update dependencies to resolve npm audit vulnerabilities fix: update deps, Node 22, OIDC release, validate Feb 24, 2026
@mhweiner mhweiner merged commit b76cba1 into main Feb 24, 2026
5 checks passed
@mhweiner mhweiner deleted the update-deps-security branch February 24, 2026 02:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant