chore: bump dependencies and fix security vulnerabilities

.github/workflows/ci.yaml

@@ -18,9 +18,9 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 24
 
@@ -39,20 +39,22 @@ jobs:
     needs: test
     permissions: write-all
     runs-on: ubuntu-24.04
+    env:
+      NODE_AUTH_TOKEN: ${{ secrets.STAFFBOT_NPM_WRITE }}
     steps:
       - name: Obtain App Token
-        uses: actions/create-github-app-token@v1.10.3
+        uses: actions/create-github-app-token@v2.0.6
         id: get_token
         with:
           app-id: ${{ vars.STAFFBASE_ACTIONS_APP_ID }}
           private-key: ${{ secrets.STAFFBASE_ACTIONS_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
           ref: ${{ github.head_ref }}
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 24.x
           registry-url: 'https://npm.pkg.github.com'
@@ -65,17 +67,16 @@ jobs:
         run: yarn build
 
       - name: Release
-        uses: cycjimmy/semantic-release-action@v4
+        uses: cycjimmy/semantic-release-action@v6
         id: semantic
         with:
           semantic_version: 23.0.0
           extra_plugins: |
             conventional-changelog-conventionalcommits
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.STAFFBOT_NPM_WRITE }}
           GITHUB_TOKEN: ${{ steps.get_token.outputs.token }}
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         if: steps.semantic.outputs.new_release_published == 'true'
         with:
           node-version: 24.x

.github/workflows/size-limit.yaml

@@ -9,7 +9,7 @@ jobs:
     env:
       CI_JOB_NUMBER: 1
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: andresz1/size-limit-action@v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/techdocs.yml

@@ -11,7 +11,7 @@ on:
 
 jobs:
   publish-techdocs-site:
-    uses: Staffbase/gha-workflows/.github/workflows/template_techdocs.yml@v11.1.0
+    uses: Staffbase/gha-workflows/.github/workflows/template_techdocs.yml@v16.0.0
     with:
       entity-name: plugins-client-sdk
     secrets:

.github/workflows/yarn.yaml

@@ -6,9 +6,9 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Yarn Lock Changes
-        uses: Simek/yarn-lock-changes@v0.12.0
+        uses: Simek/yarn-lock-changes@v0.14.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           collapsibleThreshold: '25'

eslint.config.js

@@ -0,0 +1,35 @@
+const { FlatCompat } = require("@eslint/eslintrc");
+const js = require("@eslint/js");
+const globals = require("globals");
+
+const compat = new FlatCompat({
+  baseDirectory: __dirname,
+  recommendedConfig: js.configs.recommended,
+});
+
+module.exports = [
+  ...compat.extends("eslint:recommended", "plugin:prettier/recommended"),
+  {
+    languageOptions: {
+      ecmaVersion: 8,
+      sourceType: "module",
+      globals: {
+        ...globals.browser,
+        ...globals.node,
+        ...globals.es6,
+        ...globals.mocha,
+      },
+    },
+    rules: {
+      "no-unused-vars": ["error", { argsIgnorePattern: "^_", caughtErrorsIgnorePattern: "^_" }],
+    },
+  },
+  {
+    files: ["test/**/*.js"],
+    languageOptions: {
+      globals: {
+        ...globals.jest,
+      },
+    },
+  },
+];

package.json

@@ -63,42 +63,52 @@
     "@babel/register": "^7.21.0",
     "@babel/runtime": "^7.21.0",
     "@commitlint/cli": "19.6.1",
-    "@commitlint/config-conventional": "17.4.4",
+    "@commitlint/config-conventional": "20.2.0",
+    "@eslint/eslintrc": "^3.3.7",
+    "@eslint/js": "^9.39.2",
     "@rollup/plugin-babel": "6.1.0",
-    "@rollup/plugin-commonjs": "24.0.1",
+    "@rollup/plugin-commonjs": "29.0.0",
     "@rollup/plugin-node-resolve": "15.3.0",
     "@rollup/plugin-strip": "3.0.4",
     "@rollup/plugin-terser": "^0.4.0",
     "@size-limit/preset-small-lib": "^12.1.0",
     "babel-jest": "29.7.0",
     "babel-plugin-istanbul": "^6.1.1",
-    "compare-versions": "^5.0.3",
-    "eslint": "^8.35.0",
+    "compare-versions": "^6.1.1",
+    "eslint": "^9.39.2",
     "eslint-config-prettier": "^9.1.0",
-    "eslint-plugin-prettier": "^4.2.1",
+    "eslint-plugin-prettier": "^5.5.6",
+    "globals": "^14.0.0",
     "husky": "^9.0.10",
     "jest": "29.7.0",
-    "jest-environment-jsdom": "^29.5.0",
+    "jest-environment-jsdom": "^30.2.0",
     "jest-extended": "4.0.2",
     "jsdoc": "^4.0.2",
-    "jsdoc-to-markdown": "^8.0.0",
-    "prettier": "^2.8.4",
+    "jsdoc-to-markdown": "^9.1.3",
+    "prettier": "^3.7.4",
     "regenerator-runtime": "0.14.1",
     "rollup": "^4.21.0",
-    "rollup-plugin-license": "3.6.0",
+    "rollup-plugin-license": "3.7.1",
     "rollup-plugin-serve": "3.0.0",
     "rollup-plugin-strip-logger": "0.4.1",
     "rollup-plugin-template-html": "0.0.3",
     "size-limit": "^12.1.0"
   },
   "resolutions": {
     "cross-spawn": "^7.0.6",
-    "lodash": "^4.18.0",
+    "lodash": "^4.18.1",
     "minimatch": "^5.1.8",
     "wrap-ansi": "^7.0.0",
     "semver": "^7.3.2",
     "serialize-javascript": "^7.0.5",
-    "esbuild": "^0.28.1"
+    "esbuild": "^0.28.1",
+    "browserslist": "^4.28.7",
+    "baseline-browser-mapping": "^2.11.0",
+    "js-yaml": "^4.3.1",
+    "@istanbuljs/load-nyc-config/js-yaml": "^3.15.1",
+    "brace-expansion": "^2.1.4",
+    "**/jsdoc/underscore": "^1.13.8",
+    "**/@commitlint/config-validator/ajv": "^8.18.0"
   },
   "packageManager": "yarn@1.22.19+sha1.4ba7fc5c6e704fce2066ecbfb0b0d8976fe62447"
 }

src/lib/connection/connector/postmessage.js

@@ -116,7 +116,7 @@ const receiveMessage = async (evt) => {
     ({
       data: [type, id, payload]
     } = evt);
-  } catch (e) {
+  } catch (_e) {
     // even thought catch-ignore is a bad style
     // there may be other participants listening
     // to messages in a different format so we

src/lib/device.js

@@ -1,4 +1,3 @@
-/* eslint-disable no-unused-vars */
 import cmd from './connection/commands';
 import sendMessage from './connection/connection';
 import { isNative, getVersion } from './app';

test/lib/app.test.js

@@ -1,5 +1,3 @@
-/* eslint-env jest, es6 */
-
 import stubPostMessage from './mocks';
 import { disconnect } from '../../src/lib/connection/connection';
 import * as App from './../../src/lib/app';

test/lib/connection/connection.test.js

@@ -1,5 +1,3 @@
-/* eslint-env jest, es6 */
-
 import stubPostMessage from './../mocks';
 import sendMessage, { disconnect } from '../../../src/lib/connection/connection.js';
 import command from '../../../src/lib/connection/commands.js';

test/lib/connection/connector/fallback.test.js

@@ -1,5 +1,3 @@
-/* eslint-env jest, es6 */
-
 import connect from '../../../../src/lib/connection/connector/fallback';
 import { disconnect } from '../../../../src/lib/connection/connector/fallback';
 import command from '../../../../src/lib/connection/commands';

test/lib/connection/connector/postmessage.test.js

@@ -1,6 +1,3 @@
-/* eslint-disable no-global-assign */
-/* eslint-env jest, es6 */
-
 import stubPostMessage from '../../mocks';
 import connect from '../../../../src/lib/connection/connector/postmessage';
 import { disconnect } from '../../../../src/lib/connection/connector/postmessage';

test/lib/connection/manager.test.js

@@ -1,6 +1,3 @@
-/* eslint-disable no-global-assign */
-/* eslint-env jest, es6 */
-
 import * as manager from '../../../src/lib/connection/manager';
 
 describe('manager', () => {

test/lib/device.test.js

@@ -1,5 +1,3 @@
-/* eslint-env jest, es6 */
-
 import { canDownload } from '../../src/lib/device';
 import connect, { disconnect } from '../../src/lib/connection/connector/fallback';
 import * as App from './../../src/lib/app';

test/lib/mocks.js

@@ -1,5 +1,3 @@
-/* eslint-env jest, es6 */
-
 /**
  * Stub the post message interface
  *