CHANGE @W-22462048@ Update Node dependencies across all packages for monthly release

[nikhil-mittal-165]

Summary

Monthly-release Node dependency refresh across the core monorepo, plus the start-of-cycle SNAPSHOT version bumps and two goldfile/mapping regenerations driven by upstream changes.

Dependency bumps (root + engine packages)

• semver 7.8.4 → 7.8.5
• @eslint/js & eslint 9.39.4 → 9.39.5
• typescript-eslint (+ @typescript-eslint/eslint-plugin, parser) 8.61.1 → 8.64.0
• eslint-plugin-jest 29.15.2 → 29.15.4 (resolves 29.16.0)
• globals 17.6.0 → 17.7.0
• unzipper 0.12.3 → 0.12.5
• csv-stringify 6.8.0 → 6.8.1
• js-yaml 4.2.0 → 4.3.0

Start-of-cycle SNAPSHOT bumps + engine-api pin cascade

First change since last release, so released packages advance one minor to -SNAPSHOT (mirrors prior dep-update commits #459 / #465):

• engine-api 0.39.0 → 0.40.0-SNAPSHOT (pin cascaded to all 10 dependants)
• eslint-engine 0.44.0 → 0.45.0-SNAPSHOT
• eslint8-engine 0.16.0 → 0.17.0-SNAPSHOT
• regex-engine 0.37.0 → 0.38.0-SNAPSHOT
• retirejs-engine 0.36.0 → 0.37.0-SNAPSHOT
• sfge-engine 0.22.0 → 0.23.0-SNAPSHOT

Goldfile / rule-mapping regeneration

• eslint-plugin-jest 29.16.0 changed rule-doc URLs → regenerated rules_OnlyLwcBaseConfig goldfile.
• typescript-eslint 8.64.0 deprecated @typescript-eslint/no-loop-func and @typescript-eslint/no-restricted-imports → removed from RULE_MAPPINGS and regenerated the TypeScript goldfile (engine now surfaces the base-rule equivalents).

Compatibility hold (Node 20 minimum)

• Held @salesforce/core at ^8.31.2: 8.32.x pulls undici 8.x, which calls a Node 22+ API (webidl.util.markAsUncloneable) and breaks the Node 20 customer minimum.
• Left eslint8-engine external deps frozen (eslint 8.57.1, @eslint/js 8.57.1, typescript 5.8.3).

Testing

• Full monorepo test suite green: 1557 passed, 0 failed (11 skipped); all Java BUILD SUCCESSFUL.
• Pre-commit version/interdependency validators pass.

[git2gus]

Git2Gus App is installed but the .git2gus/config.json doesn't have right values. You should add the required configuration.

[aruntyagiTutu]

Solid, well-justified release-prep PR:

• All deps bumped are minor/patch only, consistent with the monthly-release cadence policy.
• Good compatibility discipline: explicitly holding @salesforce/core at ^8.31.2 to keep undici off Node 22-only APIs and preserve the Node 20 customer minimum — exactly the kind of reasoning that should accompany a version hold.
• The websocket-driver critical-advisory fix is a clean, scoped lockfile-only bump that resolves the CVE without touching the pinned @salesforce/core version.
• Removing the two rules deprecated by typescript-eslint 8.64.0 (no-loop-func, no-restricted-imports) from RULE_MAPPINGS and regenerating the goldfiles is the right call since the engine now surfaces the base-rule equivalents.
• Tests green (1557/0/11 skipped), Java build green.

Two non-blocking notes:

1. The PR description states typescript-eslint 8.61.1 → 8.64.0, but the lockfile diff shows the @typescript-eslint/* sub-packages moving 8.62.0 → 8.65.0 — worth double-checking the description reflects the final pushed versions before merge.
2. Since two TS rules are dropped from RULE_MAPPINGS, it might be worth a release-note mention that customers relying on no-loop-func/no-restricted-imports will now get the upstream base-rule equivalents instead — just so it's not a silent behavior change from the user's perspective.

Approving — nothing here blocks merge.

[nikhil-mittal-165]

PMD 7.25.0 → 7.26.0 scan comparison — misalignment analysis & no-regression confirmation

I ran the full scan-comparison (baseline 7.25.0 vs. new 7.26.0, --rule-selector pmd) across 435 repos. The headline number looks alarming at first glance, so here is the complete breakdown.

TL;DR

No regressions. The comparison surfaces 13,206 "mismatches", but 13,171 of them (99.7%) are cosmetic — a 1-based column re-basing of ECMAScript/JavaScript violation positions in 7.26.0, plus a handful of index-pairing artifacts that fall out of it. Same rule, same file, same line, same message — only the reported column/endColumn moved.

The only 35 real behavioral changes are all intended and documented in the PMD 7.26.0 changelog, and the net violation count moves by just +20 across ~172,000 violations.

	7.25.0	7.26.0	Δ
Total violations (across the 16 affected repos)	172,076	172,096	+20

+20 = +35 new-rule detections − 15 false-positive fixes. Fully reconciled below.

---

Scope

• 435 repos scanned; 419 are perfect matches (0 diffs).
• 16 repos show any mismatch. 3 of them — forcedotcom/aura, forcedotcom/aura-note, SalesforceMobileSDK-Windows — produce 99.5% of the count, and their total violation counts are identical between versions (delta 0). That is the tell: thousands of "mismatches", zero net change → not a behavior change.

---

Full classification of all 13,206 mismatches

Category	Count	Real change?	What it is
JS position shift (column/endColumn, +1)	12,795	❌ No	Same violation, column reported 1 char to the right
JS position shift (other multi-line/offset)	194	❌ No	Same violation, position re-based across a line boundary
JS index-mispairing artifact	167	❌ No	Comparison tool pairs violations by index; the position shift nudged sort order in huge minified files, so adjacent JS violations get compared against the wrong partner. Both still exist in both runs (net-zero).
New rule: InvocableClassNoArgConstructor	35	✅ Yes (intended)	Brand-new Apex rule shipped in 7.26.0
ApexSOQLInjection removed	12	✅ Yes (intended)	False-positive fix in 7.26.0
ApexCRUDViolation removed	3	✅ Yes (intended)	False-positive fix in 7.26.0
Total	13,206		Net violation delta: +20

---

The 35 real changes — all map to the PMD 7.26.0 changelog

1. InvocableClassNoArgConstructor — 35 NEW violations (a new rule, not a regression)
PMD 7.26.0 adds this Apex rule: "flags classes with @InvocableVariable properties lacking a no-arg constructor." These are genuine new detections we now surface. Example (afawcett/df18-dx-demo):

BeerAction.cls:32 — Class 'Request' defines @InvocableVariable fields but has no accessible no-argument constructor.

Distribution: alexed1/LightningFlowComponents (29), plus 1–2 each in df18-dx-demo, NPSP, apex-recipes, apex-trigger-actions-framework, approvalsOnFlow.

2. ApexSOQLInjection — 12 violations removed (false-positive fix)
Maps to PMD issue #2955 — "[apex] ApexSOQLInjection: False positive when passing local var with concatenating strings" (labeled a:false-positive, fixed in milestone 7.26.0 via PR #6765). The rule was incorrectly flagging safe queries built by concatenating string literals into a local variable before passing to Database.query(). 7.26.0 correctly stops reporting these. Distribution: NPSP (5), EDA (2), Volunteers-for-Salesforce (2), pkChunking / FlowEmailComposer / FindNearby (1 each).

3. ApexCRUDViolation — 3 violations removed (false-positive fix)
Maps to PMD issue #3877 — "[apex] ApexCRUDViolation: False positive with Lists of Objects with getSObjectType().getDescribe()" (labeled false-positive, fixed in milestone 7.26.0 via PR #6769). The rule was incorrectly flagging a DML update on a List of records even when getSObjectType().getDescribe().isUpdateable() had already been checked. Distribution: Partner-Onboarding (1), Volunteers-for-Salesforce (2).

All three are improvements (one new rule + two false-positive fixes). None is a lost/changed detection of existing behavior.

---

Why the 13,171 cosmetic diffs happen

Every cosmetic mismatch is a JavaScript/ECMAScript violation whose position moved by exactly +1 column — everything else (rule, file, line, message, severity, tags) is byte-for-byte identical:

7.25.0:  column 13,  endColumn 109   IfStmtsMustUseBraces-javascript
7.26.0:  column 14,  endColumn 110   IfStmtsMustUseBraces-javascript   ← +1, nothing else changed

• It's JavaScript-only: 13,122 of the sampled mismatches carry the JavaScript tag. Zero Apex position shifts. This is a re-basing of the ECMAScript parser's reported column offset (0-based → 1-based style), not a rule change. The PMD 7.26.0 changelog has no JavaScript/ECMAScript/Rhino entries, consistent with this being an incidental offset adjustment rather than intended rule work.
• Why 3 repos dominate: the shift multiplies across large bundled/minified JS files. In aura, ~2,075 of the diffs are in a single file — ckeditor.js — plus its CKEditor plugins, where hundreds of statements sit on one line, so a 1-char re-base fans out into thousands of position diffs on identical findings. aura, aura-note, and the mobile SDK all vendor CKEditor / large JS bundles; a normal Apex repo like apex-recipes shows a single diff.
• The 167 "mispairing" diffs are a side effect of the same shift: the comparison tool pairs violations by ordinal index, and the position change slightly perturbs sort order in those giant files, so a window of adjacent JS violations gets diffed against the wrong neighbor until they resync. Both violations exist in both runs — net-zero, no lost findings.

---

Conclusion

✅ Safe to proceed with the 7.26.0 upgrade.

• 419/435 repos are perfect matches.
• 99.7% of diffs are a cosmetic +1 column re-base on JavaScript violations (no rule/behavior change).
• The only 15 removals are documented false-positive fixes (ApexSOQLInjection #2955, ApexCRUDViolation #3877).
• The only 35 additions are a new, documented Apex rule (InvocableClassNoArgConstructor).
• No existing Apex detection was lost or altered; no regressions.

Full per-repo reports and raw result JSON are attached (output_pmd_7_25_vs_pmd_7_26.zip) and uploaded to the shared Drive folder.