[ab7z]

Summary

This pull request removes the vulnerable and unused development dependencies, moves the linter to ESLint 10, adds a test suite and a Dependabot configuration, and corrects four small defects of the client. The client behaves as version 3.3.0: no request body, no return value and no public signature changes. The version is 3.3.1.

Client (src/domrobot.ts)

• CLIENT_VERSION is equal to the package version again. It was 3.0.2 since 2019, so the User-Agent reported a wrong version. A test now compares the constant with package.json.
• The client sends no Cookie: null header when it has no cookie (before a login and after a logout).
• A response that is not JSON still gives a SyntaxError, but the message now names the API method and the HTTP status, and the parse error is the cause.
• Debug mode masks the parameters pass and tan. Before, it printed the password of account.login.
• The doc comments of callApi() now describe what the code does for clientTransactionId, language, cacheOption and nextjsOptions.

Not changed on purpose: the handling of clTRID and lang, the stored cookie value, the result of logout() and the two-factor flow. These have known defects, but a correction changes what existing users send or get, so it belongs to a major version.

Tests

• New: test/domrobot.test.js, 22 tests with the Node.js test runner and a fake fetch (no network, no new package). npm test builds and runs them.
• Some tests fix the behaviour of 3.3.0 on purpose (for example clTRID/lang and the logout() result), so that a later change of it is a conscious decision.

Tooling

• Removed the unused packages browserify and @types/otplib, and @typescript-eslint/eslint-plugin and eslint-config-prettier.
• ESLint 10 with a flat configuration (eslint.config.mjs) and the typescript-eslint package. The current source needed no correction.
• New lockfile: 106 packages (300 before). npm audit reports 0 vulnerabilities.
• .github/dependabot.yml for npm and GitHub Actions: weekly, grouped updates of development packages, a group for their security updates, a cooldown of 7 days.
• CI: Node.js 24, actions/checkout@v7 and actions/setup-node@v7, explicit build and test steps. The job name format is unchanged, because it is the required status check.
• Publish workflow: Node.js 24. It now fails when the release tag is not v plus the version of package.json, and it runs the tests before the publish.
• package.json has a files field. The package contains lib, src, package.json and README.md (14 files; 3.3.0 had 19 with the workflow and configuration files).
• tsconfig.json: module is commonjs. The compiled output is the same as before.

How this was checked

• Format check, lint, build and the 22 tests pass locally.
• A comparison of the published 3.3.0 with this build over 29 scenarios with a fake fetch: 27 are identical. The other 2 differ only in the error text for a response that is not JSON and in the masked password of the debug output.
• A run against the OT&E API with three test accounts, with 3.3.0 and with this build: login, session test, read calls, session restore with a stored cookie, logout. All 10 steps give the same result codes for both builds.

Notes for the review

• This is the first run of the changed workflow (CI). Please look at its result.
• The js-yaml package is no longer in the dependency tree, so Bump js-yaml from 4.1.0 to 4.1.1 #32 has no effect after this change and can be closed.
• Dependabot is paused for this repository at this time. The new configuration file or a closed Dependabot pull request starts it again.