[SDK-766] Upgrade dev toolchain to clear Dependabot alerts

[devtools-agent]

Resolves Linear ticket SDK-766. This clears all 11 open Dependabot alerts on this repo in a single PR.

Why

All 11 alerts are npm, dev-only, and transitive. They come from three outdated dev tools:

Tool	Alerts
eslint 6.8	tmp (#45, #67), flatted (#52), sprintf-js (#104), the last via js-yaml 3 → argparse 1
mocha 7.2	pins js-yaml 3.13.1 (#46, #75, #80, #86, #88) and minimatch 3.0.4 (#50)
nyc 15	uuid 8 (#66), plus sprintf-js again via @istanbuljs/load-nyc-config → js-yaml 3

sprintf-js (#104) has no patched version, so the only fix is to remove it from the tree. That means moving off eslint ≤7 and off nyc altogether: every nyc release, including the latest, still pulls in js-yaml 3.

What changed

• eslint ^6.8 → ^8.57.1. The existing .eslintrc works unchanged.
• mocha ^7.2 → ^11.8. Its engines field allows Node ^18.18.
• nyc replaced by c8 ^10.1.3. The test script swaps nyc for c8. c8 doesn't read YAML config, so the same 90/80/80/90 thresholds move from .nycrc.yml to .c8rc.json. c8 has no watermarks option, so those report-colouring settings are dropped. .nyc_output is removed from .gitignore.
• Scoped overrides in package.json: mocha > serialize-javascript ^7.0.5 and mocha > diff ^8.0.3. Without them, mocha 11 brings in serialize-javascript 6.0.2 (high and moderate advisories) and diff 7, which would raise new alerts as soon as this merges.
• test/deploy.test.js and test/sourcemaps.test.js: three done => { test callbacks become function(done) {. They call this.timeout(5000), and inside an arrow function this is the suite rather than the test. Mocha 7 ignored that; mocha 11 leaves a stray timer and npm test exits non-zero.

There are no runtime dependency changes. The production entries in package-lock.json keep the same versions; three are only hoisted. version is not bumped, per AGENTS.md.

Validation

• Node 20.19.2 / npm 9, after npm ci: npm audit reports 0 vulnerabilities, npm run lint passes, npm test gives 47 passing and 1 pending (the existing it.skip), with coverage at 97.04 / 92.35 / 98.07 / 97.04 (statements / branches / functions / lines).
• Node 18.20.8 / npm 10, from a fresh npm install (same steps as CI): lint passes and gives the same 47 passing, 1 pending, and same coverage. There are two dev-only EBADENGINE warnings: serialize-javascript@7 (only loaded in mocha's --parallel mode, which isn't used here) and brace-expansion@5 (via c8 → test-exclude → minimatch 10, which ran fine on 18).
• I confirmed the c8 gate still enforces thresholds: forcing --lines 99 makes it exit 1.

Caveats

• eslint 8 is past end-of-life, but it has no open advisories. A follow-up could move to eslint 9/10 with flat config, plus mocha 12 and c8 11+, once Node 18 is dropped from the CI matrix.

🤖 Generated with Claude Code

[rollbar-circleci-machine]

AI Agent Review (openai, openai-astra)

Review: nyc to c8, eslint 6 to 8, mocha 7 to 11

I found no problems in the changed lines. Lint, tests and coverage were not run here, and nothing in the diff shows they pass under the new toolchain.

What I checked:

• c8 config: c8 finds .c8rc.json on its own and accepts check-coverage, lines, branches, functions and statements (node_modules/c8/lib/parse-args.js:21,85-114). Its temp data goes to coverage/tmp (parse-args.js:169-171), which the existing coverage entry in .gitignore already covers, so dropping .nyc_output is safe. The thresholds match the old .nycrc.yml.
• Lockfile: the root entry matches package.json (package-lock.json:7-29), and nyc is gone from the tree.
• Overrides: the nested overrides.mocha block resolves to diff@8.0.4 (package-lock.json:1790-1797) and serialize-javascript@7.1.2 (package-lock.json:2226-2234). diff@8 still ships a CommonJS build and exports createPatch (node_modules/mocha/node_modules/diff/package.json:31,41-44, libcjs/index.js:56). That is the only diff function mocha's base reporter calls (node_modules/mocha/lib/reporters/base.js:16,521).
• Test edits: changing done => to function(done) in test/deploy.test.js and test/sourcemaps.test.js makes this.timeout(5000) act on the test itself. No other test still calls this.* from an arrow function, and there is no leftover mocha.opts or .mocharc for mocha 11 to ignore.

Notes outside the findings:

• Node 18 CI job (.github/workflows/node.js.yml:36-37): two new packages declare they need Node 20+: serialize-javascript@7.1.2 (>=20.0.0, package-lock.json:2231-2233) and test-exclude's brace-expansion@5.0.12 (20 || >=22, package-lock.json:2415-2417). With no engine-strict in .npmrc, npm install will only warn. Mocha loads serialize-javascript only in --parallel mode (node_modules/mocha/lib/mocha.js:1109-1110, lib/nodejs/buffered-worker-pool.js:16), and brace-expansion's CommonJS build has no Node 20-only code. Node 18 is end-of-life, so consider dropping it from the matrix in a follow-up.
• Coverage report colours: .nycrc.yml set custom watermarks, and the new .c8rc.json doesn't carry them over. c8 does support them (node_modules/c8/lib/commands/report.js:30), so the HTML report's colour bands go back to the defaults. Thresholds are unaffected.
• c8 numbers may differ from nyc: c8 uses V8's built-in coverage instead of instrumenting the code, so the reported percentages can shift a little against the 90/80/80/90 thresholds. Confirm with the CI run.
• eslint 8.57.1 is deprecated (package-lock.json:904). Its recommended ruleset is stricter than eslint 6's, so make sure npm run lint passes. Moving to eslint 9 with flat config can be a separate PR.
• Existing issue, not from this PR: .eslintignore doesn't list coverage/. A local npm run lint run after npm test may lint the generated HTML-report scripts. CI is unaffected because the lint job runs on a fresh checkout.