LAB-2974 - Update linting dependencies, migrate tests to Vitest, and add custom ESLint rule

[pr0uxx]

LAB-2974

This pull request introduces a new custom ESLint rule to enforce that all assertGuardEquals calls are preceded by a specific V8 ignore comment, integrates this rule into the linting configuration, migrates the test runner from Node's built-in test module to Vitest, and updates several dependencies. The changes improve code quality enforcement, modernize the testing workflow, and ensure better maintainability.

Custom ESLint Rule and Linting Enhancements:

• Added a new custom ESLint rule (v8-ignore-assert-guard-equals) that requires all assertGuardEquals calls to be preceded by the comment /* v8 ignore next -- @preserve */. The rule auto-fixes legacy or missing comments and is documented and tested. (config/linter/customRules/v8IgnoreAssertGuardEquals.ts)
• Integrated the custom rule into the ESLint configuration, registered it under a custom-rules plugin, and enabled it as a warning. (config/linter/base.ts) [1] [2] [3]

Testing and Tooling Modernization:

• Migrated all test scripts from Node's test runner to Vitest, adding scripts for running, watching, and collecting coverage for both unit and integration tests. (package.json)
• Added Vitest and its V8 coverage provider as development dependencies. (package.json)
• Provided Vitest configuration files for both unit and integration tests. (vitest.unit.config.ts, vitest.integration.config.ts) [1] [2]
• Updated an existing unit test to use Vitest instead of Node's test module. (test/unit/eslint.test.ts)
• Added a comprehensive test suite for the new ESLint rule using Vitest and ESLint's RuleTester. (test/unit/linter/customRules/v8IgnoreAssertGuardEquals.test.ts)

Dependency and Version Updates:

• Updated ESLint, eslint-plugin-jsdoc, typescript-eslint, and other related dependencies to their latest versions. (package.json)
• Bumped the package version and updated the npm package manager version. (package.json) [1] [2]

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	typescript-eslint@​8.63.0 ⏵ 8.66.0			+1
	@​vitest/​coverage-v8@​4.1.10
	vitest@​4.1.10
	@​types/​node@​26.1.1 ⏵ 26.2.0	+1		+1
	eslint-plugin-jsdoc@​63.0.13 ⏵ 64.0.1	+11
	eslint@​10.7.0 ⏵ 10.8.1	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Dynamic code execution: npm @vitest/snapshot Eval Type: Function Location: Package overview From: package-lock.json → npm/vitest@4.1.10 → npm/@vitest/snapshot@4.1.10 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/snapshot@4.1.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		System shell access: npm detect-libc in module child_process Module: child_process Location: Package overview From: package-lock.json → npm/vitest@4.1.10 → npm/detect-libc@2.1.2 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/detect-libc@2.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential vulnerability: npm es-module-lexer with risk level "medium" Location: Package overview From: package-lock.json → npm/vitest@4.1.10 → npm/es-module-lexer@2.3.1 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-module-lexer@2.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Dynamic code execution: npm magicast Eval Type: Function Location: Package overview From: package-lock.json → npm/@vitest/coverage-v8@4.1.10 → npm/magicast@0.5.4 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/magicast@0.5.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential typosquat (AI signal): npm obug as a typo of dbug Did you mean: odbug From: package-lock.json → npm/vitest@4.1.10 → npm/@vitest/coverage-v8@4.1.10 → npm/obug@2.1.4 ℹ Read more on: This package | This alert | What is AI-detected potential typosquatting? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Given the AI system's identification of this package as a potential typosquat, please verify that you did not intend to install a different package. Be cautious, as malicious packages often use names similar to popular ones. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/obug@2.1.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Dynamic code execution: npm source-map-js Eval Type: Function Location: Package overview From: package-lock.json → npm/vitest@4.1.10 → npm/@vitest/coverage-v8@4.1.10 → npm/source-map-js@1.2.1 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/source-map-js@1.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		System shell access: npm tinyexec in module node:child_process Module: node:child_process Location: Package overview From: package-lock.json → npm/vitest@4.1.10 → npm/tinyexec@1.3.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tinyexec@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Unmaintained: npm has-flag was last published 5 years ago Last Publish: 7/19/2021, 5:30:54 PM From: package-lock.json → npm/@vitest/coverage-v8@4.1.10 → npm/has-flag@4.0.0 ℹ Read more on: This package | This alert | What are unmaintained packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/has-flag@4.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Unmaintained: npm html-escaper was last published 5 years ago Last Publish: 2/18/2021, 8:35:19 AM From: package-lock.json → npm/@vitest/coverage-v8@4.1.10 → npm/html-escaper@2.0.2 ℹ Read more on: This package | This alert | What are unmaintained packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/html-escaper@2.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Dynamic module loading: npm istanbul-reports Location: Package overview From: package-lock.json → npm/@vitest/coverage-v8@4.1.10 → npm/istanbul-reports@3.2.0 ℹ Read more on: This package | This alert | What is dynamic require? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid dynamic imports when possible. Audit the use of dynamic require to ensure it is not executing malicious or vulnerable code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/istanbul-reports@3.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Unmaintained: npm siginfo was last published 6 years ago Last Publish: 6/16/2020, 8:30:23 PM From: package-lock.json → npm/vitest@4.1.10 → npm/siginfo@2.0.0 ℹ Read more on: This package | This alert | What are unmaintained packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/siginfo@2.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Unmaintained: npm stackback was last published 14 years ago Last Publish: 10/20/2012, 12:56:54 AM From: package-lock.json → npm/vitest@4.1.10 → npm/stackback@0.0.2 ℹ Read more on: This package | This alert | What are unmaintained packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/stackback@0.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[Copilot]

Pull request overview

This PR modernizes the repo’s linting and test tooling by introducing a custom ESLint rule to enforce a specific V8 ignore directive for assertGuardEquals, integrating it into the base ESLint config, and migrating unit/integration tests to Vitest alongside dependency updates.

Changes:

• Added and enabled a custom ESLint rule (custom-rules/v8-ignore-assert-guard-equals) with autofix support plus a dedicated test suite.
• Migrated tests from Node’s built-in runner to Vitest, adding Vitest config for unit/integration runs and coverage.
• Updated lint/tooling dependencies and bumped the package version.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
vitest.unit.config.ts	Adds Vitest unit test/coverage configuration.
vitest.integration.config.ts	Adds Vitest integration test/coverage configuration.
test/unit/linter/customRules/v8IgnoreAssertGuardEquals.test.ts	Adds Vitest + RuleTester coverage for the new custom ESLint rule.
test/unit/eslint.test.ts	Migrates existing lint-config import test to Vitest.
package.json	Updates scripts to use Vitest; bumps versions and adds Vitest deps.
package-lock.json	Locks updated dependency graph including Vitest additions.
config/linter/customRules/v8IgnoreAssertGuardEquals.ts	Introduces the new custom ESLint rule enforcing the V8 ignore directive.
config/linter/base.ts	Registers and enables the new custom rule via a custom-rules plugin.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.