Resolve TypeScript ESLint dependency conflicts

Align the parser and plugin on v8, migrate removed lint rules, and constrain transitive overrides to compatible major versions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.eslintrc.json

@@ -28,7 +28,7 @@
       "error",
       {"allowExpressions": true}
     ],
-    "@typescript-eslint/func-call-spacing": ["error", "never"],
+    "func-call-spacing": ["error", "never"],
     "@typescript-eslint/no-array-constructor": "error",
     "@typescript-eslint/no-empty-interface": "error",
     "@typescript-eslint/no-explicit-any": "error",
@@ -49,9 +49,7 @@
     "@typescript-eslint/promise-function-async": "error",
     "@typescript-eslint/require-array-sort-compare": "error",
     "@typescript-eslint/restrict-plus-operands": "error",
-    "semi": "off",
-    "@typescript-eslint/semi": ["error", "never"],
-    "@typescript-eslint/type-annotation-spacing": "error",
+    "semi": ["error", "never"],
     "@typescript-eslint/unbound-method": "error"
   },
   "env": {

package.json

@@ -46,14 +46,15 @@
   "devDependencies": {
     "@types/jest": "^29.5.14",
     "@types/node": "^24",
+    "@types/semver": "^7.8.0",
     "@types/spdx-expression-parse": "^4.0.0",
-    "@typescript-eslint/eslint-plugin": "^6.21.0",
-    "@typescript-eslint/parser": "^8.69.0",
+    "@typescript-eslint/eslint-plugin": "^8.68.0",
+    "@typescript-eslint/parser": "^8.68.0",
     "@vercel/ncc": "^0.45.0",
     "esbuild-register": "^3.6.0",
     "eslint": "^8.57.0",
     "eslint-plugin-github": "^4.10.2",
-    "eslint-plugin-jest": "^29.16.6",
+    "eslint-plugin-jest": "29.16.5",
     "eslint-plugin-prettier": "^5.5.6",
     "js-yaml": "^4.3.1",
     "nodemon": "^3.1.14",
@@ -61,9 +62,10 @@
     "typescript": "^5.9.2"
   },
   "overrides": {
-    "cross-spawn": ">=7.0.5",
+    "cross-spawn": "^7.0.5",
+    "eslint-plugin-escompat": "3.4.0",
     "@octokit/request-error@5.0.1": "5.1.1",
-    "undici": ">=6.27.0",
-    "minimatch": ">=9.0.7"
+    "undici": "^6.27.0",
+    "minimatch": "^9.0.7"
   }
 }

src/comment-pr.ts

@@ -20,12 +20,10 @@ export async function commentPr(
   config: ConfigurationOptions,
   issueFound: boolean
 ): Promise<void> {
-  if (
-    !(
-      config.comment_summary_in_pr === 'always' ||
-      (config.comment_summary_in_pr === 'on-failure' && issueFound)
-    )
-  ) {
+  if (!(
+    config.comment_summary_in_pr === 'always' ||
+    (config.comment_summary_in_pr === 'on-failure' && issueFound)
+  )) {
     return
   }
 

src/config.ts

@@ -216,10 +216,9 @@ async function getRemoteConfig(configOpts: {
       ref: configOpts.ref
     })
 
-    // When using mediaType.format = 'raw', the response.data is a string
-    // but this is not reflected in the return type of getContent, so we're
-    // casting the return value to a string.
-    return z.string().parse(data as unknown)
+    // When using mediaType.format = 'raw', the response data is a string,
+    // but getContent's return type does not reflect that, so validate it here.
+    return z.string().parse(data)
   } catch (error) {
     core.debug(error as string)
     throw new Error('Error fetching remote config file')

src/licenses.ts

@@ -17,9 +17,7 @@ import * as spdx from './spdx'
  * @returns {Promise<{Object.<string, Array.<Change>>}} A promise to a Record Object. The keys are strings, unlicensed, unresolved and forbidden. The values are a list of changes
  */
 export type InvalidLicenseChangeTypes =
-  | 'unlicensed'
-  | 'unresolved'
-  | 'forbidden'
+  'unlicensed' | 'unresolved' | 'forbidden'
 export type InvalidLicenseChanges = Record<InvalidLicenseChangeTypes, Changes>
 export async function getInvalidLicenseChanges(
   changes: Change[],
@@ -84,7 +82,7 @@ export async function getInvalidLicenseChanges(
             invalidLicenseChanges.unresolved.push(change)
           }
         }
-      } catch (err) {
+      } catch {
         invalidLicenseChanges.unresolved.push(change)
       }
     }
@@ -107,7 +105,7 @@ const fetchGHLicense = async (
       repo
     })
     return response.data.license?.spdx_id ?? null
-  } catch (_) {
+  } catch {
     return null
   }
 }
@@ -123,7 +121,7 @@ const parseGitHubURL = (url: string): {owner: string; repo: string} | null => {
       return null
     }
     return {owner: components[1], repo: components[2]}
-  } catch (_) {
+  } catch {
     return null
   }
 }

src/scorecard.ts

@@ -4,7 +4,7 @@ import * as core from '@actions/core'
 export async function getScorecardLevels(
   changes: Change[]
 ): Promise<Scorecard> {
-  const data: Scorecard = {dependencies: []} as Scorecard
+  const data: Scorecard = {dependencies: []}
   for (const change of changes) {
     const ecosystem = change.ecosystem
     const packageName = change.name

src/spdx.ts

@@ -15,7 +15,7 @@ export function satisfies(candidateExpr: string, allowList: string[]): boolean {
   candidateExpr = cleanInvalidSPDX(candidateExpr)
   try {
     return spdxSatisfies(candidateExpr, allowList)
-  } catch (_) {
+  } catch {
     return false
   }
 }
@@ -28,7 +28,7 @@ export function satisfiesAny(
   candidateExpr = cleanInvalidSPDX(candidateExpr)
   try {
     return spdxlib.satisfiesAny(candidateExpr, licenses)
-  } catch (_) {
+  } catch {
     return false
   }
 }
@@ -41,7 +41,7 @@ export function satisfiesAll(
   candidateExpr = cleanInvalidSPDX(candidateExpr)
   try {
     return spdxlib.satisfiesAll(candidateExpr, licenses)
-  } catch (_) {
+  } catch {
     return false
   }
 }
@@ -52,7 +52,7 @@ export function isValid(spdxExpr: string): boolean {
   try {
     parse(spdxExpr)
     return true
-  } catch (_) {
+  } catch {
     return false
   }
 }

src/summary.ts

@@ -135,7 +135,7 @@ function extractPatchVersionId(patchData: unknown): string | null {
 
   // Handle object format with identifier field (for backward compatibility)
   if (patchData && typeof patchData === 'object' && 'identifier' in patchData) {
-    const id = (patchData as {identifier: unknown}).identifier
+    const id = patchData.identifier
     return typeof id === 'string' ? id : null
   }
 
@@ -422,8 +422,7 @@ export async function addChangeVulnerabilitiesToSummary(
           // Find matching entry by ecosystem, package name (case-insensitive), and version range
           // Use pre-normalized values from cache to avoid repeated lowercasing and range conversion
           let foundEntry:
-            | {eco: string; pkg: string; range: string; patch: string}
-            | undefined
+            {eco: string; pkg: string; range: string; patch: string} | undefined
           for (const vulnEntry of advisoryEntries) {
             if (vulnEntry.ecoLower !== ecoLowercase) continue
             if (vulnEntry.pkgLower !== packageLowercase) continue