[kumilingus]

Summary

Upgrades eslint-plugin-sonarjs from 3.0.5 to 4.2.2 in @joint/eslint-config.

3.0.5 depends on exactly [email protected], which has known ReDoS advisories. Because the pin is exact, it can't be refreshed in range. 4.x depends on minimatch ^10.2.6, and [email protected] is no longer in the lockfile.

TypeScript resolution

eslint-plugin-sonarjs declares typescript (>=5 <6.1.0) as a regular dependency, not a peer dependency. Yarn resolves that range on its own and installs a nested [email protected] for the plugin. The parser (typescript-eslint) uses the hoisted 5.8.2.

SyntaxKind values differ between the two versions. 244 is ExpressionStatement in 5.8 and VariableStatement in 6.0. So the plugin treated a top-level describe(...) as a variable statement and crashed:

TypeError: Cannot read properties of undefined (reading 'declarations')
Rule: "sonarjs/assertions-in-tests"
    at getRequiredModuleNames (eslint-plugin-sonarjs/cjs/helpers/module-ts.js:193:46)

A root resolution makes the plugin use the same TypeScript as the parser:

"eslint-plugin-sonarjs/typescript": "5.8.2"

If the exact 5.8.2 pins are bumped later, this resolution has to move with them.

Lint fixes in @joint/react tests

The new rule versions reported 39 errors, all in @joint/react tests:

Rule	Count	Fix
sonarjs/prefer-specific-assertions	23	expect(x.length).toBe(n) → expect(x).toHaveLength(n)
sonarjs/assertions-in-tests	9	Added real assertions: not.toThrow() around smoke renders, resolves.toBeUndefined(), spies on setGrid / matrix for the grid/transform test, a toHaveLength(1) sanity check in benchmarks (as the other benchmarks do)
sonarjs/no-trivial-assertions	4	Replaced expect(true).toBe(true) with real checks. The two compile-only type test files keep it, with a disable comment and the reason
sonarjs/no-floating-point-equality	3	toBe(0.x) → toBeCloseTo(0.x)

eslint --fix also removed 5 disable directives that no longer suppress anything.

Testing

• yarn lint passes in all workspaces
• yarn workspace @joint/react run test passes: typecheck, knip, coverage, and Jest on React 19 (1065 tests) and React 18 (1061 tests)
• yarn install --immutable is clean