build(deps): bump dependencies and migrate to ESLint 10 flat config

Bump all safe dependencies to latest major versions:
- @cyclonedx/cyclonedx-library 6→10, https-proxy-agent 7→9, p-limit 4→7
- chai 4→6, mocha 10→11, sinon 15→22, sinon-chai 3→4
- eslint 8→10, typescript 5→6, which 5→7, @types/node 20→25

Migrate ESLint configuration:
- Convert .eslintrc.json to eslint.config.js (flat config, required by ESLint 10)
- Replace eslint-plugin-import with eslint-plugin-import-x (ESLint 10 support)
- Replace eslint-plugin-editorconfig with equivalent built-in ESLint rules
  (plugin uses removed context.getFilename API incompatible with ESLint 10)

Fix Mocha 11 breaking change:
- Convert all suite().beforeAll().afterAll() chains to use
  suiteSetup()/suiteTeardown() inside suite callbacks (chaining API removed)

Add dependabot ignore for packageurl-js (blocked on upstream purl spec
issue for '+' encoding in versions, see package-url/packageurl-js#90).

Closes guacsec#542

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Strum355

.github/dependabot.yml

@@ -9,6 +9,10 @@ updates:
     exclude-paths:
       - "test/providers/tst_manifests/**"
       - "test/providers/provider_manifests/**"
+    ignore:
+      # Blocked on upstream purl spec issue for '+' encoding in versions.
+      # See: https://github.com/package-url/packageurl-js/pull/90
+      - dependency-name: "packageurl-js"
     groups:
       npm-dependencies:
         patterns:

eslint.config.js

@@ -0,0 +1,54 @@
+import js from "@eslint/js";
+import importPlugin from "eslint-plugin-import-x";
+import globals from "globals";
+
+export default [
+	js.configs.recommended,
+	{
+		plugins: {
+			"import-x": importPlugin,
+		},
+		languageOptions: {
+			ecmaVersion: 2022,
+			sourceType: "module",
+			globals: {
+				...globals.node,
+				...globals.mocha,
+				...globals.es2021,
+			},
+		},
+		rules: {
+			...importPlugin.configs.recommended.rules,
+			"no-unused-vars": ["error", { "caughtErrors": "none" }],
+			"preserve-caught-error": "off",
+			// editorconfig enforcement (replaces eslint-plugin-editorconfig)
+			"eol-last": ["error", "always"],
+			"indent": ["error", "tab"],
+			"linebreak-style": ["error", "unix"],
+			"no-trailing-spaces": "error",
+			"unicode-bom": ["error", "never"],
+			"curly": "warn",
+			"eqeqeq": ["warn", "always", {"null": "never"}],
+			"no-throw-literal": "warn",
+			"import-x/order": ["warn", {
+				"groups": ["builtin", "external", "internal", "parent", "sibling", "index"],
+				"newlines-between": "always",
+				"alphabetize": {
+					"order": "asc",
+					"caseInsensitive": true,
+				},
+			}],
+		},
+		settings: {
+			"typescript": {},
+			"import-x/resolver": {
+				"typescript": {
+					"extensions": [".js"],
+				},
+			},
+		},
+	},
+	{
+		ignores: ["index.js", "dist/**"],
+	},
+];

test/exhort-backend-utils.test.js

@@ -12,6 +12,10 @@ suite('testing Select Trustify DA Backend function', () => {
 	const testUrl = 'https://trustify-da.example.com';
 	const testUrl2 = 'https://dev.trustify-da.example.com';
 
+	suiteTeardown(() => {
+		delete process.env['TRUSTIFY_DA_BACKEND_URL'];
+	});
+
 	test('When TRUSTIFY_DA_BACKEND_URL is set in environment variable, should return that value', () => {
 		process.env['TRUSTIFY_DA_BACKEND_URL'] = testUrl;
 		let selectedUrl = selectTrustifyDABackend({});
@@ -64,18 +68,17 @@ suite('testing Select Trustify DA Backend function', () => {
 		};
 		expect(() => selectTrustifyDABackend(testOpts)).to.throw('TRUSTIFY_DA_BACKEND_URL is unset');
 	});
-
-}).afterAll(() => {
-	delete process.env['TRUSTIFY_DA_BACKEND_URL'];
 });
 
 suite('verify token header logging', () => {
+	suiteSetup(() => sinon.spy(console, 'log'));
+	suiteTeardown(() => console.log.restore());
+
 	test('don\'t log the token header', () => {
 		getTokenHeaders({
 			'TRUSTIFY_DA_TOKEN': 'banana',
 			'TRUSTIFY_DA_DEBUG': 'true'
 		})
-		// Should only be called once with "Headers Values to be sent to Trustify DA backend:"
 		expect(console.log).to.be.calledOnce
 	})
-}).beforeAll(() => sinon.spy(console, 'log')).afterAll(() => console.log.restore())
+});

test/providers/golang_gomodules.test.js

@@ -9,6 +9,8 @@ import golangGoModules from "../../src/providers/golang_gomodules.js"
 
 let clock
 suite('testing the golang-go-modules data provider', () => {
+	suiteSetup(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z')));
+	suiteTeardown(() => clock.restore());
 	[
 		{name: 'go.mod', expected: true},
 		{name: 'some_other.file', expected: false}
@@ -81,6 +83,6 @@ suite('testing the golang-go-modules data provider', () => {
 		}).timeout(process.env.GITHUB_ACTIONS ? 30000 : 10000)
 
 	})
-}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(()=> clock.restore());
+});
 
 

test/providers/java_gradle_groovy.test.js

@@ -27,6 +27,8 @@ function getStubbedResponse(args, dependencyTreeTextContent, gradleProperties) {
 }
 
 suite('testing the java-gradle-groovy data provider', () => {
+	suiteSetup(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z')));
+	suiteTeardown(() => clock.restore());
 
 	[
 		{ name: 'build.gradle', expected: true },
@@ -100,5 +102,5 @@ suite('testing the java-gradle-groovy data provider', () => {
 			throws(() => provider.provideComponent(`test/providers/tst_manifests/gradle/${testCase}/build.gradle`, {}))
 		})
 	})
-}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => { clock.restore() });
+});
 

test/providers/java_gradle_kotlin.test.js

@@ -27,6 +27,8 @@ function getStubbedResponse(args, dependencyTreeTextContent, gradleProperties) {
 }
 
 suite('testing the java-gradle-kotlin data provider', () => {
+	suiteSetup(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z')));
+	suiteTeardown(() => clock.restore());
 
 	[
 		{ name: 'build.gradle.kts', expected: true },
@@ -100,5 +102,5 @@ suite('testing the java-gradle-kotlin data provider', () => {
 			throws(() => provider.provideComponent(`test/providers/tst_manifests/gradle/${testCase}/build.gradle`, {}))
 		})
 	})
-}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => { clock.restore() });
+});
 

test/providers/java_maven.test.js

@@ -48,6 +48,8 @@ async function createMockProvider(testPath) {
 
 const mvnPath = await which('mvn');
 suite('testing the java-maven data provider', async () => {
+	suiteSetup(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z')));
+	suiteTeardown(() => clock.restore());
 
 	[
 		{name: 'pom.xml', expected: true},
@@ -126,9 +128,11 @@ suite('testing the java-maven data provider', async () => {
 		// these test cases takes ~1400-2000 ms each pr >10000 in CI (for the first test-case)
 
 	})
-}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(()=> {clock.restore()});
+});
 
 suite('testing the java-maven data provider with modules', () => {
+	suiteSetup(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z')));
+	suiteTeardown(() => clock.restore());
 	[
 		"pom_with_one_module",
 		"pom_with_multiple_modules"
@@ -155,9 +159,11 @@ suite('testing the java-maven data provider with modules', () => {
 		// these test cases takes ~1400-2000 ms each pr >10000 in CI (for the first test-case)
 
 	})
-}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(()=> {clock.restore()});
+});
 
 suite('testing the java-maven version parsing in getDependencies', () => {
+	suiteSetup(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z')));
+	suiteTeardown(() => clock.restore());
 	test('verify version parsing works correctly', async () => {
 		const testCase = 'pom_deps_with_ignore_version_from_property';
 		const javaMvnProvider = await createMockProvider(`test/providers/tst_manifests/maven/${testCase}`);
@@ -174,4 +180,4 @@ suite('testing the java-maven version parsing in getDependencies', () => {
 		expect(bouncyCastleDependency).to.exist;
 		expect(bouncyCastleDependency.ref).to.equal('pkg:maven/org.bouncycastle/bcprov-jdk18on@1.80');
 	});
-}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(()=> {clock.restore()});
+});

test/providers/javascript.test.js

@@ -54,6 +54,8 @@ async function createMockProvider(providerName, listingOutput) {
 }
 
 suite('testing the javascript-npm data provider', async () => {
+	suiteSetup(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z')));
+	suiteTeardown(() => clock.restore());
 	[
 		{ name: 'npm/with_lock_file', validation: true },
 		{ name: 'npm/without_lock_file', validation: false },
@@ -371,4 +373,4 @@ suite('testing the javascript-npm data provider', async () => {
 			.to.throw('package.json requires a lock file')
 	})
 
-}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore());
+});

test/providers/oci_images.test.js

@@ -7,6 +7,8 @@ import { generateImageSBOM, parseImageRef } from '../../src/oci_image/utils.js';
 
 let clock;
 suite('testing the OCI image data provider', () => {
+	suiteSetup(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z')));
+	suiteTeardown(() => clock.restore());
 	[
 		"httpd@sha256:4b5cb7697fea2aa6d398504c381b693a54ae9ad5e6317fcdbb7a2d9b8c3b1364",
 		"httpd:2.4.49",
@@ -36,4 +38,4 @@ suite('testing the OCI image data provider', () => {
 		}).timeout(10000)
 	})
 
-}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore());
+});

test/providers/python_pip.test.js

@@ -49,6 +49,8 @@ async function sharedStackAnalysisTestFlow(testCase, usePipDepTreeUtility) {
 }
 
 suite('testing the python-pip data provider', () => {
+	suiteSetup(() => clock = useFakeTimers(new Date('2023-10-01T00:00:00.000Z')));
+	suiteTeardown(() => clock.restore());
 	[
 		{name: 'requirements.txt', expected: true},
 		{name: 'some_other.file', expected: false}
@@ -84,9 +86,11 @@ suite('testing the python-pip data provider', () => {
 		}).timeout(process.env.GITHUB_ACTIONS ? 15000 : 10000)
 	});
 
-}).beforeAll(() => clock = useFakeTimers(new Date('2023-10-01T00:00:00.000Z'))).afterAll(()=> clock.restore());
+});
 
 suite('testing the python-pip data provider with virtual environment', () => {
+	suiteSetup(() => clock = useFakeTimers(new Date('2023-10-01T00:00:00.000Z')));
+	suiteTeardown(() => clock.restore());
 	[
 		"pip_requirements_virtual_env_txt_no_ignore",
 		"pip_requirements_virtual_env_with_ignore"
@@ -115,9 +119,11 @@ suite('testing the python-pip data provider with virtual environment', () => {
 		}).timeout(process.env.GITHUB_ACTIONS ? 60000 : 30000)
 	})
 
-}).beforeAll(() => {clock = useFakeTimers(new Date('2023-10-01T00:00:00.000Z'))}).afterAll(()=> clock.restore());
+});
 
 suite('testing python-pip PEP 508 marker handling', () => {
+	suiteSetup(() => clock = useFakeTimers(new Date('2023-10-01T00:00:00.000Z')));
+	suiteTeardown(() => clock.restore());
 	const markerTestCase = 'pip_requirements_txt_marker_skip'
 
 	/** Verify that packages with environment markers (PEP 508) that are not installed
@@ -153,9 +159,11 @@ suite('testing python-pip PEP 508 marker handling', () => {
 		}
 	}).timeout(10000)
 
-}).beforeAll(() => clock = useFakeTimers(new Date('2023-10-01T00:00:00.000Z'))).afterAll(() => clock.restore());
+});
 
 suite('testing python-pip SHA-256 hash extraction via pip inspect', () => {
+	suiteSetup(() => clock = useFakeTimers(new Date('2023-10-01T00:00:00.000Z')));
+	suiteTeardown(() => clock.restore());
 	const hashTestCase = 'pip_requirements_txt_with_hashes'
 
 	const pipFreezeOutput = 'certifi==2023.7.22\nsix==1.16.0\n'
@@ -276,9 +284,11 @@ suite('testing python-pip SHA-256 hash extraction via pip inspect', () => {
 		}
 	}).timeout(10000)
 
-}).beforeAll(() => clock = useFakeTimers(new Date('2023-10-01T00:00:00.000Z'))).afterAll(() => clock.restore());
+});
 
 suite('testing python-pip SHA-256 hashes with real pip inspect', () => {
+	suiteSetup(() => clock = useFakeTimers(new Date('2023-10-01T00:00:00.000Z')));
+	suiteTeardown(() => clock.restore());
 	const testCase = 'pip_requirements_txt_with_hashes'
 
 	/** Verifies SBOM components include SHA-256 hashes from real pip inspect. */
@@ -302,4 +312,4 @@ suite('testing python-pip SHA-256 hashes with real pip inspect', () => {
 		}
 	}).timeout(process.env.GITHUB_ACTIONS ? 30000 : 10000)
 
-}).beforeAll(() => clock = useFakeTimers(new Date('2023-10-01T00:00:00.000Z'))).afterAll(() => clock.restore());
+});