chore(deps): batch trivial dependency updates

[jamesbhobbs]

Summary

Batch-applies the Renovate dependency updates that need no substantive source
changes, verified locally against the full CI suite. Each update was triaged
individually rather than per-PR, so mixed group PRs are split.

Included updates

Dependency	Change	Source PR
reflect-metadata	^0.1.12 → ^0.2.0	#284
flatted	3.4.2 → 3.4.4	#457
@lumino/widgets	^2.4.0 → ^2.9.0	#329
re-resizable	^6.5.5 → ^6.11.2	#282
@actions/glob	^0.5.1 → ^0.7.0	#289 (partial)
@vscode/test-cli	^0.0.8 → ^0.0.15	#289 (partial)
@vscode/test-web	^0.0.71 → ^0.0.81	#289 (partial)
cspell	9.2.1 → 9.8.0	#289 (partial)
lint-staged	16.2.3 → 16.4.0	#289 (partial)
source-map	^0.7.4 → ^0.8.0	#289 (partial)
@types/pdfkit	^0.11.0 → ^0.17.0	#288 (partial)
@types/react-json-tree	^0.6.8 → ^0.13.0	#288 (partial)
@types/stack-trace	0.0.29 → 0.0.33	#288 (partial)
@types/temp	^0.8.32 → ^0.9.0	#288 (partial)

Supporting changes

• mocha pinned to 11.0.1 (was ^11.0.1). @vscode/test-cli 0.0.15
  requires mocha ^11.7.6, which pulled the hoisted root mocha up to
  11.8.0. That version loads the --require bootstrap (out/test/unittests.js)
  as ESM, and the entire unit suite dies with
  ReferenceError: require is not defined in ES module scope. Pinning keeps
  the root at 11.0.1 while @vscode/test-cli resolves its own nested copy.
  Adapting the bootstrap to mocha 11.8 is real source work and belongs in its
  own PR.
• License-checker exclusion bumped from
  @cspell/dict-en-common-misspellings@2.1.6 to @2.2.0. The exclusion is
  version-pinned, and cspell 9.8.0 resolves the newer dictionary (same
  non-SPDX license as before), so check-licenses fails without this.
• Removed a stale @ts-expect-error in plotViewer.node.ts.
  @types/pdfkit 0.17 now ships declarations for
  pdfkit/js/pdfkit.standalone, so the directive became unused and tripped
  noUnusedTsExpectError.

Skipped (left for follow-up)

Dependency	Reason	Source PR
glob ^9.3.5 → ^10	Needs source changes. Verified locally: 10 files use import glob from 'glob', and v10 has no default export (TS2613), plus callback→promise API changes. Security PR — worth a dedicated fix.	#382
react-svgmt 1.1.11 → 1.2.0	ERESOLVE: peer react@^17, repo is on react@16.14.0. Blocked on a React major.	#268
@nteract/transform-vega → 7.0.10	Pulls @blueprintjs/core 3.54 and friends; both audit jobs fail.	#281
Node.js 22 → 24 (.nvmrc)	Runtime/environment change rather than a package update, and it drives lockfile drift via a different bundled npm.	#285
@types/* remainder of the DefinitelyTyped group	Not in the four taken above; the group's lockfile also bumps types that break typecheck.	#288

Verification

Run locally in a worktree on Node 22.21.1 / npm 10.9.4:

Check	Result
tsc -p ./	pass (0 errors)
npm run lint	pass
npm run format	pass
npm run spell-check	pass (0 issues)
npm run check-licenses	pass
npm audit --omit=dev	pass (0 vulnerabilities)
npx tsx build/esbuild/build.ts	pass
npm run test:unittests	2762 passing, 0 failing
npm install idempotency (drift check)	pass — no lockfile diff

npm audit (including dev) still reports the same 5 low-severity elliptic
findings as main; those resolutions are byte-identical to main and are not
introduced here.

Lockfile note

The lockfile was rebased on main and re-resolved only for the targeted
dependencies, rather than blanket-regenerated. A full re-resolution drifted 309
transitive packages — including typescript 5.8.3 → 5.9.3, which introduced 4
typecheck errors. This PR keeps typescript and @types/node unchanged.

After merge

#284, #457, #329, and #282 are fully included and can be closed. #288 and #289
were partially included and will shrink when Renovate rebases them.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SLK3q2h5EwTC9hFs1bEwLJ

Summary by CodeRabbit

• Maintenance
  • Updated runtime and development components to newer compatible versions, improving ongoing stability and maintainability.
  • Refined license-checking compatibility with the latest spelling-dictionary package.
  • Removed an unnecessary internal warning suppression while preserving existing PDF export behavior.
  • No user-facing changes to plotting or PDF generation are expected.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 668f5bba-cc98-4eb1-aa9b-b40719824fea

📥 Commits

Reviewing files that changed from the base of the PR and between 3318624 and 0b9a814.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• package.json
• src/webviews/extension-side/plotting/plotViewer.node.ts

💤 Files with no reviewable changes (1)

• src/webviews/extension-side/plotting/plotViewer.node.ts

Included review availability: 3 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

---

📝 Walkthrough

Walkthrough

The change updates runtime, development-tool, type-package, license-exclusion, and override versions in package.json. It also removes the TypeScript suppression before the dynamic pdfkit import. The PDF export flow remains unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 0b9a8

This PR batches dependency and lockfile updates with supporting metadata cleanup, and the reported validation checks pass; no actionable merge-blocking risk remains beyond normal review.

Suggested reviewers: tkislan

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: a batch of dependency updates with minor maintenance changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Updates Docs	✅ Passed	The PR changes dependency constraints and removes an obsolete TypeScript directive; it does not implement a feature, so documentation updates are not required by this check.

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0%. Comparing base (3318624) to head (0b9a814).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@     Coverage Diff     @@
##   main   #474   +/-   ##
===========================
===========================

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jamesbhobbs]

Merged main into this branch to resolve conflicts — no force push.

main had picked up the ESLint → oxlint migration (#468). The only conflicting file was package-lock.json; package.json merged cleanly.

How the lockfile conflict was resolved: rather than merging lock entries, I took main's lockfile as the base and re-resolved it against the merged package.json. That preserves the oxlint migration's resolutions byte-for-byte and re-resolves only the batched dependency bumps. typescript and @types/node are unchanged from main.

All 15 dependency changes survived the merge (flatted lives in overrides, not dependencies). The only source-file difference from main is still the single @ts-expect-error removal in plotViewer.node.ts.

The lockfile also shows 131 removals vs main — those are all deduped nested copies of small packages (has-flag, color-convert, color-name, ansi-styles) collapsing under hoisting, plus fast-memoize which re-resizable 6.11.2 drops. Additions are the nested mocha tree created by the root pin and @actions/* from the @actions/glob bump.

Re-verified on the merged tree (note: lint is now oxlint src):

Check	Result
tsc -p ./	pass (0 errors)
npm run lint (oxlint)	pass
npm run format	pass
npm run spell-check	pass
npm run check-licenses	pass
npm audit --omit=dev	pass (0 vulnerabilities)
npx tsx build/esbuild/build.ts	pass
npm run test:unittests	2762 passing, 0 failing
npm install idempotency	pass — no drift

For the record, all 12 CI checks were green on the pre-merge commit (bd5e37ff1), including E2E.

[tkislan]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.