chore(deps): upgrade npm toolchain and remediate alerts

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ jobs:
     name: Code Coverage & Memory Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7.0.1
 
       - name: Install Dependencies
         run: |
@@ -52,7 +52,7 @@ jobs:
           lcov --list coverage.info
 
       - name: Upload Coverage to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v7.0.0
         with:
           files: ./build/coverage.info
           fail_ci_if_error: false
@@ -124,7 +124,7 @@ jobs:
       MSBUILD_PATH: "C:/Program Files (x86)/Microsoft Visual Studio/2019/Enterprise/MSBuild/Current/Bin"
     steps:
       - name: Checkout code
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@v7.0.1
         with:
           submodules: recursive
       - name: Create Build Directory
@@ -135,7 +135,10 @@ jobs:
         run: |
           sudo apt update
           sudo apt install -y ${{ matrix.CC }} || echo "Compiler already installed"
-          if [[ "${{ matrix.CXX }}" != *"clang"* ]]; then sudo apt install -y ${{ matrix.CXX }} || echo "C++ compiler already installed"; fi
+          case "${{ matrix.CXX }}" in
+            *clang*) ;;
+            *) sudo apt install -y ${{ matrix.CXX }} || echo "C++ compiler already installed" ;;
+          esac
 
       - name: Execute CMake Process
         env:
@@ -159,21 +162,29 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6.4.0
         with:
-          node-version: '18'
+          node-version: '26.7.0'
+          package-manager-cache: false
+
+      - name: Setup npm
+        working-directory: ${{ runner.temp }}
+        run: npm install --global npm@12.0.2
 
       - name: Install dependencies
-        run: npm install
+        run: npm ci
 
       - name: Run ESLint
         run: npm run lint
 
+      - name: Run dependency security tests
+        run: npm run test:security
+
       - name: Setup Emscripten
-        uses: mymindstorm/setup-emsdk@v14
+        uses: emscripten-core/setup-emsdk@v16
         with:
           version: latest
 
@@ -201,10 +212,10 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7.0.0
         with:
           python-version: '3.11'
 
@@ -215,3 +226,35 @@ jobs:
 
       - name: Test Conan package
         run: conan create . --build=missing
+
+  dependency-validation:
+    name: Dependency and Toolchain Validation
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7.0.1
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6.4.0
+        with:
+          node-version: '26.7.0'
+          package-manager-cache: false
+
+      - name: Setup npm
+        working-directory: ${{ runner.temp }}
+        run: npm install --global npm@12.0.2
+
+      - name: Install locked dependencies
+        run: npm ci
+
+      - name: Verify pinned toolchain
+        run: npm run test:toolchain
+
+      - name: Verify direct dependencies are current
+        run: npm outdated --depth=0
+
+      - name: Audit dependencies
+        run: npm audit --audit-level=moderate
+
+      - name: Run dependency security regression tests
+        run: npm run test:security

.github/workflows/release.yml

@@ -220,10 +220,15 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6.4.0
         with:
-          node-version: '18'
+          node-version: '26.7.0'
           registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false
+
+      - name: Setup npm
+        working-directory: ${{ runner.temp }}
+        run: npm install --global npm@12.0.2
 
       - name: Download WASM artifact
         uses: actions/download-artifact@v4
@@ -232,7 +237,7 @@ jobs:
           path: docs
 
       - name: Install dependencies
-        run: npm install
+        run: npm ci
 
       - name: Run linting
         run: npm run lint

.nvmrc

@@ -0,0 +1 @@
+26.7.0

CONTRIBUTING.md

@@ -21,7 +21,7 @@ Thank you for your interest in contributing to ipv6-parse! This document provide
 
 2. **CMake** 3.12+
 
-3. **Node.js** 12+ and npm (for JavaScript/WASM)
+3. **Node.js** 26.7.0 and npm 12.0.2 (for JavaScript/WASM)
 
 4. **Emscripten SDK** (for WebAssembly):
    ```bash
@@ -40,7 +40,7 @@ git clone https://github.com/jrepp/ipv6-parse.git
 cd ipv6-parse
 
 # Install Node.js dependencies
-npm install
+npm ci
 
 # Build WASM module (requires Emscripten)
 ./build_wasm.sh
@@ -169,7 +169,7 @@ npm run lint:fix         # Auto-fix issues
 - Use single quotes for strings
 - 2-space indentation
 - Semicolons required
-- Follow ESLint rules (see `.eslintrc.json`)
+- Follow ESLint rules (see `eslint.config.js`)
 
 ### Build Validation
 

docs/ipv6-parse-api.js

@@ -43,7 +43,7 @@ class IPv6Parser {
       try {
         this._resultSize = this._module.ccall('ipv6_result_size', 'number', [], []);
         this._diagSize = this._module.ccall('ipv6_diag_size', 'number', [], []);
-      } catch (e) {
+      } catch {
         // Fall back to hardcoded sizes
       }
     }
@@ -184,7 +184,7 @@ class IPv6Parser {
       );
 
       return result === 0; // IPV6_COMPARE_OK
-    } catch (err) {
+    } catch {
       return false;
     }
   }
@@ -197,7 +197,7 @@ class IPv6Parser {
   getVersion() {
     try {
       return this._module.ccall('ipv6_version', 'string', [], []);
-    } catch (err) {
+    } catch {
       return 'unknown';
     }
   }

eslint.config.js

@@ -0,0 +1,58 @@
+'use strict';
+
+const js = require('@eslint/js');
+const globals = require('globals');
+const { defineConfig } = require('eslint/config');
+
+module.exports = defineConfig([
+  {
+    name: 'project/ignores',
+    ignores: [
+      'build/**',
+      'build_wasm/**',
+      'build_test/**',
+      'bin/**',
+      'coverage/**',
+      'docs/ipv6-parse.js',
+      '**/*.min.js'
+    ]
+  },
+  js.configs.recommended,
+  {
+    name: 'project/javascript',
+    files: ['**/*.js'],
+    languageOptions: {
+      ecmaVersion: 'latest',
+      sourceType: 'commonjs',
+      globals: {
+        ...globals.browser,
+        ...globals.node
+      }
+    },
+    rules: {
+      indent: ['error', 2],
+      'linebreak-style': ['error', 'unix'],
+      quotes: ['error', 'single', { avoidEscape: true }],
+      semi: ['error', 'always'],
+      'no-unused-vars': ['error', { argsIgnorePattern: '^_' }],
+      'no-console': 'off',
+      'no-trailing-spaces': 'error',
+      'eol-last': ['error', 'always'],
+      'object-curly-spacing': ['error', 'always'],
+      'array-bracket-spacing': ['error', 'never'],
+      'comma-dangle': ['error', 'never'],
+      'arrow-spacing': ['error', { before: true, after: true }],
+      'keyword-spacing': ['error', { before: true, after: true }],
+      'space-before-blocks': ['error', 'always'],
+      'space-before-function-paren': ['error', {
+        anonymous: 'always',
+        named: 'never',
+        asyncArrow: 'always'
+      }],
+      'space-in-parens': ['error', 'never'],
+      'space-infix-ops': 'error',
+      'prefer-const': 'error',
+      'no-var': 'error'
+    }
+  }
+]);