fix: resolve dependency advisories blocking publication

.github/workflows/publish-packages.yml

@@ -21,6 +21,7 @@ jobs:
       contents: read
     env:
       APPROVED_COMMIT: ${{ inputs.commit }}
+      NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
     steps:
       - uses: actions/checkout@v7
         with:
@@ -39,7 +40,6 @@ jobs:
       - uses: actions/setup-node@v7
         with:
           node-version: 22
-          registry-url: https://registry.npmjs.org/
       - run: pnpm install --frozen-lockfile
       - name: Audit dependencies
         run: |
@@ -53,7 +53,7 @@ jobs:
             (.advisories | type == "object") and
             (.metadata.vulnerabilities | keys == ["critical", "high", "info", "low", "moderate"]) and
             (.metadata.vulnerabilities | all(.[]; type == "number" and . >= 0)) and
-            (([.metadata.vulnerabilities[]] | add) == (.advisories | length)) and
+            (([.metadata.vulnerabilities[]] | add) == ([.advisories[].findings | length] | add // 0)) and
             (($status == 0 and (.advisories | length) == 0) or
              ($status == 1 and (.advisories | length) > 0)) and
             (.advisories | all(.[];

.github/workflows/security-audit.yml

@@ -36,7 +36,7 @@ jobs:
             (.advisories | type == "object") and
             (.metadata.vulnerabilities | keys == ["critical", "high", "info", "low", "moderate"]) and
             (.metadata.vulnerabilities | all(.[]; type == "number" and . >= 0)) and
-            (([.metadata.vulnerabilities[]] | add) == (.advisories | length)) and
+            (([.metadata.vulnerabilities[]] | add) == ([.advisories[].findings | length] | add // 0)) and
             (($status == 0 and (.advisories | length) == 0) or
              ($status == 1 and (.advisories | length) > 0)) and
             (.advisories | all(.[];

eslint.config.js

@@ -0,0 +1,90 @@
+import tseslint from '@typescript-eslint/eslint-plugin';
+import parser from '@typescript-eslint/parser';
+import noExtraneousDependencies from 'eslint-plugin-import-x/rules/no-extraneous-dependencies';
+import { createTypeScriptImportResolver } from 'eslint-import-resolver-typescript';
+import prettier from 'eslint-plugin-prettier/recommended';
+import globals from 'globals';
+
+export default [
+  {
+    ignores: [
+      '**/node_modules/**',
+      '**/coverage/**',
+      '**/dist/**',
+      '**/*.js',
+      '**/*.d.ts',
+      'index.ts',
+      'packages/cli/bin/**',
+    ],
+  },
+  ...tseslint.configs['flat/recommended'],
+  prettier,
+  {
+    files: ['**/*.ts'],
+    languageOptions: {
+      parser,
+      globals: globals.node,
+      parserOptions: {
+        project: ['./tsconfig.json'],
+        tsconfigRootDir: import.meta.dirname,
+      },
+    },
+    // The full plugin imports minimatch's removed makeRe API in an unused rule.
+    // Load the enabled rule through its public subpath export instead.
+    plugins: {
+      'import-x': {
+        rules: { 'no-extraneous-dependencies': noExtraneousDependencies },
+      },
+    },
+    settings: {
+      'import-x/resolver-next': [
+        createTypeScriptImportResolver({
+          alwaysTryTypes: true,
+          project: `${import.meta.dirname}/tsconfig.json`,
+        }),
+      ],
+    },
+    rules: {
+      'no-useless-constructor': 'off',
+      'no-unused-expressions': 0,
+      'one-var': 0,
+      'no-underscore-dangle': [
+        0,
+        {
+          allow: [],
+        },
+      ],
+      'global-require': 0,
+      'new-cap': 'off',
+      '@typescript-eslint/no-unsafe-declaration-merging': 'off',
+      '@typescript-eslint/no-namespace': 'off',
+      '@typescript-eslint/no-explicit-any': 0,
+      '@typescript-eslint/explicit-function-return-type': 0,
+      camelcase: 'off',
+      'consistent-return': 0,
+      'lines-between-class-members': 'off',
+      'import-x/no-extraneous-dependencies': [
+        'error',
+        {
+          devDependencies: true,
+          optionalDependencies: false,
+          peerDependencies: false,
+        },
+      ],
+      '@typescript-eslint/consistent-type-imports': [
+        'error',
+        {
+          prefer: 'type-imports',
+          disallowTypeAnnotations: false,
+        },
+      ],
+      '@typescript-eslint/no-unused-vars': [
+        'error',
+        {
+          argsIgnorePattern: '^_',
+          varsIgnorePattern: '^_',
+        },
+      ],
+    },
+  },
+];

package.json

@@ -9,7 +9,7 @@
     "url": "https://github.com/codotech/contractual.git"
   },
   "engines": {
-    "node": ">=22.0.0"
+    "node": "^22.22.2 || ^24.15.0 || ^26.0.0"
   },
   "bugs": {
     "url": "https://github.com/codotech/contractual.git"
@@ -35,23 +35,24 @@
   },
   "devDependencies": {
     "@types/node": "^22.20.4",
-    "@typescript-eslint/eslint-plugin": "^6.21.0",
-    "@typescript-eslint/parser": "^6.21.0",
+    "@typescript-eslint/eslint-plugin": "^8.72.1",
+    "@typescript-eslint/parser": "^8.72.1",
     "@vitest/coverage-v8": "^4.1.12",
-    "eslint": "^8.57.1",
+    "eslint": "^10.14.0",
     "eslint-config-prettier": "^9.1.2",
-    "eslint-import-resolver-typescript": "^3.10.1",
-    "eslint-plugin-import": "^2.32.0",
+    "eslint-import-resolver-typescript": "^4.4.5",
+    "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-prettier": "^5.5.6",
+    "globals": "^17.13.0",
     "husky": "^8.0.3",
     "json-schema-typed": "^8.0.2",
-    "lerna": "^9.0.7",
+    "lerna": "^10.1.1",
     "lint-staged": "^14.0.1",
     "prettier": "^3.9.9",
     "rimraf": "^6.1.3",
     "typescript": "~5.7.3",
-    "vitest": "^4.1.12",
     "vite": "^7.3.7",
+    "vitest": "^4.1.12",
     "yaml": "^2.8.3"
   },
   "lint-staged": {
@@ -63,7 +64,6 @@
   "pnpm": {
     "overrides": {
       "micromatch@<4.0.8": "4.0.8",
-      "minimatch@>=9.0.0 <9.0.7": "9.0.7",
       "yaml@>=2.0.0 <2.8.3": "^2.8.3",
       "vite@>=7.0.0 <7.3.7": "^7.3.7",
       "esbuild@>=0.27.3 <0.28.1": "0.28.1",
@@ -73,15 +73,18 @@
       "axios@>=1.0.0 <1.20.0": "1.20.0",
       "pacote@>=21.0.0 <21.5.1": "21.5.1",
       "smol-toml@<1.9.0": "1.9.0",
-      "nx@>=22.0.0 <22.7.10": "22.7.10",
       "source-map-js@>=1.0.0 <1.2.2": "1.2.2",
       "postcss-selector-parser@<7.1.6": "7.1.6",
       "handlebars@>=4.0.0 <4.7.10": "4.7.10",
       "follow-redirects@<1.16.1": "1.16.2",
       "http-cache-semantics@>=4.0.0 <4.3.0": "4.3.0",
       "ip-address@>=10.0.0 <10.7.4": "10.7.4",
       "undici@>=6.0.0 <6.29.1": "6.29.1",
-      "fast-uri@>=3.0.0 <3.1.9": "3.1.9"
+      "fast-uri@>=3.0.0 <3.1.9": "3.1.9",
+      "minimatch@>=9.0.0 <11.0.3": "11.0.3",
+      "glob@>=9.0.0 <14.0.3": "14.0.3",
+      "undici@>=7.0.0 <7.30.1": "7.30.1",
+      "conventional-commits-parser@>=7.0.0 <7.1.3": "7.1.3"
     }
   }
 }

packages/cli/package.json

@@ -41,7 +41,7 @@
     }
   ],
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=22.12.0"
   },
   "scripts": {
     "prebuild": "pnpm rimraf dist",

packages/differs.openapi/package.json

@@ -19,7 +19,7 @@
     "directory": "packages/differs.openapi"
   },
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=22.12.0"
   },
   "scripts": {
     "prebuild": "rimraf dist",
@@ -32,7 +32,7 @@
   "dependencies": {
     "@contractual/differs.core": "workspace:*",
     "@contractual/types": "workspace:*",
-    "@redocly/openapi-core": "^1.34.20"
+    "@redocly/openapi-core": "^2.72.1"
   },
   "devDependencies": {
     "rimraf": "^6.1.3",

packages/governance/package.json

@@ -30,7 +30,7 @@
     "url": "https://github.com/codotech/contractual/issues"
   },
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=22.12.0"
   },
   "scripts": {
     "prebuild": "pnpm rimraf dist",
@@ -50,7 +50,7 @@
     "ajv-formats": "^3.0.1"
   },
   "devDependencies": {
-    "@redocly/openapi-core": "^1.34.20",
+    "@redocly/openapi-core": "^2.72.1",
     "vitest": "^4.1.12"
   },
   "publishConfig": {