fix: migrate to eslint 10 flat config, patch vitest advisory and release 3.0.2

CHANGELOG.md

@@ -4,6 +4,22 @@ The three original packages (`@wilsoon/auth-core`, `@wilsoon/auth-react`,
 `@wilsoon/auth-next`) are versioned together. `@wilsoon/auth-machine` has no dependency on
 them and is versioned independently, starting at 0.x.
 
+## 3.0.2
+
+Maintenance. No API or behaviour changes, and no change to any runtime dependency - `jose`
+is still the only one, and `pnpm audit --prod` was already clean.
+
+### Changed - `@wilsoon/auth-core`, `@wilsoon/auth-react`, `@wilsoon/auth-next`, and `@wilsoon/auth-machine` 0.1.2
+
+- **Development dependencies repaired for security advisories.** Vitest moved to 4.1.11 in
+  every package (GHSA-82fw-gwwq-j7x9: path traversal through `@vitest/mocker`), along with
+  the build and test toolchain. These never ship in a published tarball.
+- **Linting moved to ESLint 10 and flat config** (`eslint.config.mjs`). The rules are
+  unchanged; `eslint-plugin-deprecation`, which stopped at ESLint 8, is replaced by
+  typescript-eslint's built-in `@typescript-eslint/no-deprecated`.
+- `getSession()` (`@wilsoon/auth-next`) drops a dead initial assignment flagged by the new
+  `no-useless-assignment` rule. Every path already assigned or returned before it was read.
+
 ## 3.0.1
 
 One fix, in the Next.js middleware.

eslint.config.mjs

@@ -0,0 +1,79 @@
+import js from "@eslint/js";
+import tsParser from "@typescript-eslint/parser";
+import tsPlugin from "@typescript-eslint/eslint-plugin";
+import jsdoc from "eslint-plugin-jsdoc";
+import globals from "globals";
+
+export default [
+  {
+    ignores: ["**/dist/", "**/node_modules/", "**/coverage/", "**/.turbo/", "**/*.config.ts", "**/*.config.js", "**/*.config.mjs"],
+  },
+
+  js.configs.recommended,
+  ...tsPlugin.configs["flat/recommended"],
+
+  {
+    files: ["**/*.{ts,tsx}"],
+    languageOptions: {
+      parser: tsParser,
+      ecmaVersion: 2022,
+      sourceType: "module",
+      parserOptions: {
+        ecmaFeatures: { jsx: true },
+        // The nearest tsconfig.json to each file - per package, and covering src/ only.
+        project: true,
+        tsconfigRootDir: import.meta.dirname,
+      },
+      globals: { ...globals.browser, ...globals.node, ...globals.es2021 },
+    },
+    plugins: { jsdoc },
+    rules: {
+      "@typescript-eslint/no-explicit-any": "off",
+      "@typescript-eslint/no-unused-vars": [
+        "warn",
+        { argsIgnorePattern: "^_", varsIgnorePattern: "^_", caughtErrors: "none" },
+      ],
+      "no-empty": ["error", { allowEmptyCatch: true }],
+      eqeqeq: ["error", "smart"],
+      "no-restricted-syntax": [
+        "warn",
+        {
+          selector: "CallExpression > MemberExpression[property.name='parseIdToken']",
+          message:
+            "parseIdToken() does not verify the token. Use verifyIdToken() to authorize, or decodeIdTokenUnsafe() for display-only claims.",
+        },
+        {
+          selector: "CallExpression > MemberExpression[property.name='isTokenExpired']",
+          message: "isTokenExpired() is deprecated. Use isTokenNearExpiry().",
+        },
+      ],
+      "@typescript-eslint/no-deprecated": "warn",
+      "jsdoc/require-jsdoc": [
+        "warn",
+        { publicOnly: true, require: { FunctionDeclaration: true, ClassDeclaration: true } },
+      ],
+      "jsdoc/require-param": "off",
+      "jsdoc/require-returns": "off",
+      "@typescript-eslint/naming-convention": [
+        "error",
+        {
+          selector: ["function", "method"],
+          filter: { regex: "(decode|parse|unverified)", match: true },
+          custom: { regex: "Unsafe$", match: true },
+          format: ["camelCase"],
+        },
+      ],
+    },
+  },
+  {
+    files: ["**/test/**/*.{ts,tsx}", "**/*.test.{ts,tsx}"],
+    languageOptions: {
+      parserOptions: { project: null },
+    },
+    rules: {
+      "no-restricted-syntax": "off",
+      "@typescript-eslint/no-non-null-assertion": "off",
+      "@typescript-eslint/no-deprecated": "off",
+    },
+  },
+];

package.json

@@ -1,7 +1,7 @@
 {
   "name": "wilsoonid-sdk",
   "private": true,
-  "packageManager": "pnpm@11.24.0",
+  "packageManager": "pnpm@12.9.1",
   "scripts": {
     "build": "turbo build",
     "dev": "turbo dev",
@@ -11,16 +11,17 @@
     "typecheck": "turbo typecheck"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
     "@types/node": "^26.6.5",
     "@typescript-eslint/eslint-plugin": "^8.71.1",
     "@typescript-eslint/parser": "^8.71.1",
     "@wilsoon/docs": "^1.5.0",
     "eslint": "^10.12.0",
-    "eslint-plugin-deprecation": "^3.0.0",
     "eslint-plugin-jsdoc": "^65.3.0",
+    "globals": "^17.13.0",
     "prettier": "^3.8.4",
     "rimraf": "^6.1.3",
     "turbo": "latest",
-    "typescript": "^7.0.2"
+    "typescript": "^5.9.3"
   }
 }

packages/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wilsoon/auth-core",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "description": "Framework-agnostic OpenID Connect relying party: discovery, PKCE, and token verification for browsers, Node and edge runtimes",
   "keywords": [
     "oidc",
@@ -46,7 +46,7 @@
   "devDependencies": {
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
-    "vitest": "^1.6.1"
+    "vitest": "^4.1.11"
   },
   "dependencies": {
     "jose": "^5.10.0"

packages/auth-machine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wilsoon/auth-machine",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Server-only OAuth 2.0 client_credentials tokens with caching, single-flight and refresh-ahead",
   "keywords": [
     "oauth2",
@@ -45,7 +45,7 @@
   "devDependencies": {
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
-    "vitest": "^1.6.1"
+    "vitest": "^4.1.11"
   },
   "engines": {
     "node": ">=18"

packages/auth-next/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wilsoon/auth-next",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "description": "OpenID Connect for the Next.js App Router: verified sessions, middleware and hardened cookie storage",
   "keywords": [
     "oidc",
@@ -58,7 +58,7 @@
     "next": "^16.4.0",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
-    "vitest": "^1.6.1"
+    "vitest": "^4.1.11"
   },
   "engines": {
     "node": ">=18"

packages/auth-next/src/server.ts

@@ -52,7 +52,7 @@ export interface GetSessionOptions {
  * why.
  */
 export async function getSession(config: AuthConfig, options: GetSessionOptions = {}): Promise<Session> {
-    let tokens: TokenResponse | null = null;
+    let tokens: TokenResponse | null;
 
     try {
         const cookieStore = await cookies();

packages/auth-react/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wilsoon/auth-react",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "description": "React context and hooks for OpenID Connect browser sessions",
   "keywords": [
     "oidc",
@@ -57,7 +57,7 @@
     "react": "^19.2.7",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
-    "vitest": "^1.6.1"
+    "vitest": "^4.1.11"
   },
   "engines": {
     "node": ">=18"