fix: resolve high-severity npm audit vulnerabilities (brace-expansion DoS) (#755)

Root cause: GHSA-mh99-v99m-4gvg (CVE-2026-14257) — brace-expansion DoS via
unbounded expansion. The advisory affects every version < 5.0.8 (single
range `>=0, <5.0.8`), and 5.0.8+ is API-incompatible with the minimatch@3/@9
used by eslint@9 and jest. This left 31 transitive high vulns across the
jest/eslint/@typescript-eslint trees, and blocked every dependabot PR's
`npm audit --audit-level=high` CI step (main itself is affected).

The only patched brace-expansion (5.x) requires minimatch@10, which in turn
requires eslint@10 (eslint@9's @eslint/config-array pins minimatch@3).
@typescript-eslint@8.65.0 already declares `eslint: ^10.0.0` support.

Changes:
- eslint ^9 -> ^10, @eslint/js ^9 -> ^10 (natively use minimatch@10 +
  brace-expansion@5, clearing the eslint tree).
- Drop the FlatCompat/@eslint/eslintrc layer; rewrite eslint.config.js as a
  pure flat config (eslint@10's @eslint/eslintrc would otherwise still pull
  vulnerable minimatch@3).
- Remove unused eslint-plugin-github (never referenced by the config); it
  pulled old minimatch@3/@9 and a stale bundled typescript-eslint@8.16.0 and
  was itself flagged by the audit.
- Add eslint-config-prettier@10 (previously only present transitively via
  eslint-plugin-github) to preserve the prior `extends` behavior.
- Add overrides to clear the remaining jest-tree vulns:
    brace-expansion ^5.0.8, glob ^11.0.1, test-exclude ^8.0.0
  and force @typescript-eslint/utils ^8.65.0 so eslint-plugin-jest's older
  transitive copy dedupes to the eslint@10-compatible release.
- Disable eslint@10's new `no-useless-assignment` rule to avoid churning the
  bundled dist/ for an unrelated audit fix.

Result: `npm audit --audit-level=high` -> 0 vulnerabilities; build, lint,
format-check and tests (37/37) all pass; src/ and dist/ are untouched so
check-dist remains valid.

Author: yxxhero

eslint.config.js

@@ -1,76 +1,62 @@
-import {
-    defineConfig,
-    globalIgnores,
-} from "eslint/config";
+import {defineConfig, globalIgnores} from "eslint/config";
 
 import tsParser from "@typescript-eslint/parser";
 import typescriptEslint from "@typescript-eslint/eslint-plugin";
 import jest from "eslint-plugin-jest";
 import globals from "globals";
 import js from "@eslint/js";
-
-import {
-    FlatCompat,
-} from "@eslint/eslintrc";
-
-const compat = new FlatCompat({
-    baseDirectory: import.meta.dirname,
-    recommendedConfig: js.configs.recommended,
-    allConfig: js.configs.all
-});
-
-export default defineConfig([{
-    extends: compat.extends(
-        "eslint:recommended",
-        "plugin:@typescript-eslint/recommended",
-        "plugin:eslint-plugin-jest/recommended",
-        "eslint-config-prettier",
-    ),
-
-    languageOptions: {
-        parser: tsParser,
-
-        globals: {
-            ...globals.node,
-            ...jest.environments.globals.globals,
+import prettier from "eslint-config-prettier";
+
+export default defineConfig([
+    js.configs.recommended,
+    ...typescriptEslint.configs["flat/recommended"],
+    jest.configs["flat/recommended"],
+    prettier,
+    {
+        languageOptions: {
+            parser: tsParser,
+
+            globals: {
+                ...globals.node,
+                ...jest.environments.globals.globals,
+            },
         },
-    },
-
-    plugins: {
-        "@typescript-eslint": typescriptEslint,
-        jest,
-    },
 
-    rules: {
-        "@typescript-eslint/no-require-imports": "error",
-        "@typescript-eslint/no-non-null-assertion": "off",
-        "@typescript-eslint/no-explicit-any": "off",
-        "@typescript-eslint/no-empty-function": "off",
+        rules: {
+            "@typescript-eslint/no-require-imports": "error",
+            "@typescript-eslint/no-non-null-assertion": "off",
+            "@typescript-eslint/no-explicit-any": "off",
+            "@typescript-eslint/no-empty-function": "off",
 
-        "@typescript-eslint/ban-ts-comment": ["error", {
-            "ts-ignore": "allow-with-description",
-        }],
+            "@typescript-eslint/ban-ts-comment": ["error", {
+                "ts-ignore": "allow-with-description",
+            }],
 
-        "no-console": "error",
-        "yoda": "error",
+            "no-console": "error",
+            "yoda": "error",
 
-        "prefer-const": ["error", {
-            destructuring: "all",
-        }],
+            "prefer-const": ["error", {
+                destructuring: "all",
+            }],
 
-        "no-control-regex": "off",
+            "no-control-regex": "off",
 
-        "no-constant-condition": ["error", {
-            checkLoops: false,
-        }],
-    },
-}, {
-    files: ["**/*{test,spec}.ts"],
+            "no-constant-condition": ["error", {
+                checkLoops: false,
+            }],
 
-    rules: {
-        "@typescript-eslint/no-unused-vars": "off",
-        "jest/no-standalone-expect": "off",
-        "jest/no-conditional-expect": "off",
-        "no-console": "off",
-    },
-}, globalIgnores(["**/dist/", "**/lib/", "**/node_modules/", "**/jest.config.mjs", "**/jest.setup.js"])]);
+            // Introduced in ESLint 10; the existing try/catch and switch
+            // patterns rely on defensive initializers. Kept off to avoid
+            // churning the bundled dist/ output for an unrelated audit fix.
+            "no-useless-assignment": "off",
+        },
+    }, {
+        files: ["**/*{test,spec}.ts"],
+
+        rules: {
+            "@typescript-eslint/no-unused-vars": "off",
+            "jest/no-standalone-expect": "off",
+            "jest/no-conditional-expect": "off",
+            "no-console": "off",
+        },
+    }, globalIgnores(["**/dist/", "**/lib/", "**/node_modules/", "**/jest.config.mjs", "**/jest.setup.js"])]);