# JavaScript lint and dependency audit

Audit date: 2026-10-13. `npm run lint` uses pinned ESLint 10.12.0, `@eslint/js` 10.0.1 and `globals` 17.13.0. Flat configuration enables recommended correctness rules, including undefined identifiers, unsafe control flow, duplicate keys and unreachable code. Node and renderer environments are separate. Serialized isolated-world DOM helpers and classic admin scripts have explicit global contracts. Narrow annotated exceptions preserve intentional control-character rejection, fixed sanitized errors, cleanup failure propagation and sensitive transient text clearing. Unused-variable warnings remain enabled, and the lint command fails on any warning. Existing unused imports and pure dead locals were removed; intentional field-stripping destructures have narrow documented annotations.

Configuration follows the official [flat-config documentation](https://eslint.org/docs/latest/use/configure/configuration-files) and [language-options documentation](https://eslint.org/docs/latest/use/configure/language-options).

`npm audit --omit=dev --json` reports zero npm advisories in production dependencies. Full `npm audit --json` reports eight moderate affected packages and zero high/critical. These eight entries form one development-tool dependency chain, rather than eight independent vulnerabilities:

`electron-builder → app-builder-lib → @electron/get → global-agent → roarr → sprintf-js@1.1.3`.

The underlying [GHSA-hp3w-g68c-fv3c / CVE-2026-97058](https://github.com/advisories/GHSA-hp3w-g68c-fv3c) concerns denial of service when attackers control numeric precision in sprintf format strings. The advisory lists versions through 1.1.3 as affected and no patched release. The registry's latest sprintf-js is also 1.1.3. Consequently there is currently no verified patched leaf version to pin. Npm proposes electron-builder 26.5.0 despite the current pinned 26.15.3; no blind downgrade or `audit fix --force` was performed.

This is a remaining build-toolchain risk. Keep package generation limited to reviewed local source/configuration, avoid attacker-supplied format templates, and recheck the advisory before release. A production npm dependency result does not audit bundled Chromium/Electron, Python/OCR/model runtimes or prove absence of vulnerabilities. Exact Electron remains pinned at 44.7.0. Package fuse tooling is pinned separately as `@electron/fuses@2.1.3`; its package fuse enforcement requires a successful package verification result.

Raw reports remain in ignored local artifacts: `artifacts/npm-audit-production.json`, `artifacts/npm-audit-full.json`, `artifacts/eslint-final.json`. Repeat both audit commands when dependencies change; do not treat this dated snapshot as permanent evidence.