Land ESLint v10 modernization (#284) + open dep/feature PRs + undici CVE fix

[chad-fossa]

Purpose

Integration / test branch — merges the open PRs together so their combined behavior gets exercised end-to-end by test.yml (real fossa analyze / test / container / report / --diff against the FOSSA key). Not intended to merge as-is; it's a green-light check that the open PRs are mutually compatible.

What's included

PR	Change	How
#303	include-unused-deps input (feature)	merged
#306	bump actions/checkout 6 → 7	merged
#284	ESLint v10 flat-config modernization (typescript-eslint + eslint-plugin-import-x, drops airbnb/standard stack)	applied
#302	eslint → 10.3.0	pinned into #284's range
#300	globals → 17.6.0	pinned into #284's range

Deliberately NOT included

Obsoleted by #284 — it removes the packages these bump:

• Bump @typescript-eslint/parser from 8.54.0 to 8.58.0 #279 @typescript-eslint/parser — package removed by Upgrade to ESLint v10 and modernize lint config #284
• Bump @typescript-eslint/eslint-plugin from 8.58.2 to 8.59.2 #301 @typescript-eslint/eslint-plugin — package removed by Upgrade to ESLint v10 and modernize lint config #284
• Bump @eslint/compat from 2.0.4 to 2.0.5 #292 @eslint/compat — package removed by Upgrade to ESLint v10 and modernize lint config #284

Preserved from main, NOT reverted (#284 was branched before these landed; a naive merge would have reverted them):

• Fix FOSSA test --diff step to work with push events #278 fossa test --diff push-event fix
• Make dependabot ignore major version upgrades to @types/node #291 dependabot @types/node major-version guard

Local verification (Node 24)

• yarn install — clean lockfile regen
• yarn lint — passes on the new flat config
• yarn build — dist/ rebuilt and in sync; include-unused-deps present in bundle

Testing

Pushing this branch triggers test.yml, which is the real e2e suite. Watch the checks tab.

[chad-fossa]

e2e result (run 28587298720)

All functional steps passed under Node 24 with every merged PR's changes:

Step	Result
lint (new flat config)	✅
Build (dist rebuild)	✅
Rebuild-dist verify (in sync)	✅
fossa analyze (+debug bundle)	✅
fossa container analyze	✅
fossa analyze --branch	✅
fossa test --project --branch	✅
fossa test (repo policy gate)	❌

The single failure is fossa test's vulnerability-policy gate on the repo's own dependency graph — 3 CVEs: lodash@4.17.5, undici@6.24.1, pydantic-ai-slim@0.0.48 (a stray Python pkg from the accumulated FOSSA project).

This is not introduced by the merge: none of those packages are in the lockfile changes, main would fail the same gate today (its last green run was 2026-04-21, before these CVEs), and the failing step is orthogonal to whether the PRs integrate. Every step that actually exercises the merged code passed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: b11b06d7-51b8-4c96-ab07-bf73020622c7

📥 Commits

Reviewing files that changed from the base of the PR and between 29693cc and 7f4dd19.

⛔ Files ignored due to path filters (3)

• dist/index.js is excluded by !**/dist/**
• dist/index.js.map is excluded by !**/dist/**, !**/*.map
• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (8)

• .github/workflows/rebuild-dist.yml
• .github/workflows/test.yml
• README.md
• action.yml
• eslint.config.mjs
• package.json
• src/config.ts
• src/index.ts

👮 Files not reviewed due to content moderation or server errors (8)

• src/config.ts
• action.yml
• .github/workflows/test.yml
• README.md
• package.json
• .github/workflows/rebuild-dist.yml
• eslint.config.mjs
• src/index.ts

---

Warning

Walkthrough skipped

File diffs could not be summarized.

---

_{Comment @coderabbitai help to get the list of available commands.}