chore(GH-483): Upgrade npm tooling and group Dependabot updates

[juhaniemi]

Ticket GH-483

Fixes #483

Changes

• ESLint 8 → 10, flat config. .eslintrc.json / .eslintignore replaced by eslint.config.js. ESLint 10 no longer reads eslintrc, and eslint-config-airbnb only supports ESLint 7–8, so the base is now @eslint/js recommended + eslint-plugin-prettier. Custom module and theme JS is linted as browser scripts with Drupal, drupalSettings, once and jQuery as globals.
• Prettier 2.7 → 3. .prettierrc.json unchanged.
• Stylelint 14 → 17. stylelint-config-standard 40, stylelint-prettier 5. Dropped stylelint-config-prettier (Stylelint 15 removed the rules it turned off) and the removed function-calc-no-invalid rule. SCSS files use stylelint-config-standard-scss, replacing the at-rule-no-unknown workaround.
• Removed: eslint-plugin-yml, eslint-plugin-import, eslint-plugin-jsx-a11y, eslint-plugin-react.
• Bumped: @playwright/test 1.64, @drupal/playwright 1.2, typescript 7, markdownlint-cli 0.49, @types/node 26, @faker-js/faker 10.6.
• npm audit: overrides pin js-yaml, smol-toml and katex under markdownlint-cli to patched versions. The only remaining finding is braces (via Stylelint's globbing), which has no patched release.
• Dependabot: weekly instead of daily, minor/patch updates grouped, Drupal core grouped, lint-stack majors grouped, GitHub Actions monthly. A fresh project gets a couple of grouped PRs instead of ~10 separate ones.

Supersedes #317, #339, #345, #346.

Independent of #482. With ESLint 10 the scaffolded web/.eslintrc.json is ignored anyway.

Testing

Enviroment: local DDEV (tooling only, no deploy needed)

Login: n/a

Instructions:

• ddev npm ci && ddev npm run lint passes
• Add a JS file with var foo="bar" to a custom module: ddev npm run lint:js reports no-unused-vars and Prettier errors
• Add SCSS with @use, @mixin and @include to a custom module: ddev npm run lint:css parses it with no unknown at-rule errors
• ddev exec npx tsc --noEmit passes
• ddev exec npx playwright test passes (7/7)

Verified in wunderio/internal-mearra-main-data-system on top of #482's fixes: lint, tsc, Playwright 7/7 and GrumPHP all pass.

https://claude.ai/code/session_012FKaDB3ZoovhEYXdXSdiUT

[Copilot]

🔵 Needs a closer look

.sass files are not covered by the SCSS Stylelint override and may be parsed or linted incorrectly.

0 open findings

What changed in this PR

Upgrades npm linting, formatting, testing, and Dependabot tooling.

Changes:

• Migrates ESLint to flat configuration.
• Updates Prettier, Stylelint, TypeScript, Playwright, and related dependencies.
• Groups Dependabot updates and adds security overrides.

File	Description
package.json	Updates tooling dependencies and security overrides
eslint.config.js	Adds flat ESLint configuration
.stylelintrc.json	Updates Stylelint and SCSS configuration
.github/​dependabot.yml	Groups and schedules dependency updates
.eslintrc.json	Removes obsolete ESLint configuration
.eslintignore	Removes obsolete ignore configuration

🧠 Review effort: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[juhaniemi]

Tested the root lint config against the org's theme repos, each copied into web/themes/custom/ (findings from npm run lint:js / lint:css):

Theme	Old root config (ESLint 8 + airbnb, Stylelint 14)	This PR
wunder-theme-base	JS 3, CSS crash (no SCSS syntax)	JS 1, CSS 96 (style, mostly --fixable)
wudo	JS 247, CSS crash (no SCSS syntax)	JS 204 (197 Prettier), CSS 903 (style, mostly --fixable)
drupal-theme (Emulsify, D9)	JS and CSS crash (own configs need the theme's own node_modules)	JS 68 (JSX components seen as unused vars), CSS crash (own config needs stylelint-config-prettier)

None of the themes was lint-clean under the old config, so there's no compatibility to preserve, but 4c5bf3c fixes a regression the first commit had: theme ES modules and JSX now parse (as with airbnb), build config files get Node globals, tests get Jest globals, storybook-static/ is ignored and selector-class-pattern is off for BEM class names.

Theme-side issues found along the way: wudo/js/import-map.js is JSON in a .js file, and drupal-theme still ships its own ESLint 8 / airbnb / Stylelint 14 stack.