Fix ESLint v9 incompatibility and Node20 ES module compatibility

[Copilot]

CI failing due to ESLint v9 requiring flat config format (eslint.config.js) instead of legacy .eslintrc.json, and Node20 incompatibility with ES module detection.

Changes

Package dependencies:

• Downgrade eslint 9.39.2 → 8.57.0
• Downgrade eslint-plugin-github 6.0.0 → 5.1.8
• Replace typescript-eslint with explicit @typescript-eslint/eslint-plugin and @typescript-eslint/parser at v8.0.0
• Remove @eslint/js (ESLint v8 incompatible)
• Downgrade yargs 18.0.0 → 17.7.2 (yargs 18+ is ESM-only, incompatible with CommonJS bundling)
• Add "type": "commonjs" to package.json to explicitly declare CommonJS module type for Node20

ESLint configuration:

• Remove deprecated formatting rules (func-call-spacing, semi, type-annotation-spacing) removed in typescript-eslint v8
• Disable import/no-unresolved (TypeScript handles import validation, avoids false positives with package.json exports)

GitHub Actions:

• Update action.yml to use node20 instead of node16 (Node16 is deprecated and GitHub Actions now runs all actions on Node20)

Node20 Compatibility Fix

GitHub Actions now automatically runs Node16 actions on Node20, which has stricter ES module detection. Node20 was detecting ES module syntax (import.meta) in the bundled dist/index.js from yargs 18.0.0 and attempting to load it as an ES module, causing ReferenceError: require is not defined in ES module scope. The fix downgrades yargs to the last CommonJS-compatible version (17.7.2) and explicitly sets "type": "commonjs" to ensure Node20 loads the action as CommonJS.

ESLint v8 maintains .eslintrc.json support, avoiding migration to flat config.

Original prompt

The CI build is failing due to an ESLint error that results in exit code 2. Log output references the ESLint migration guide, suggesting a misconfiguration or plugin version mismatch. Steps to resolve:

1. Verify and update package.json to ensure compatibility among eslint, eslint-plugin-github, @typescript-eslint/eslint-plugin, and @typescript-eslint/parser. Example:

"devDependencies": {
"eslint": "^8.0.0",
"eslint-plugin-github": "^4.3.1",
"@typescript-eslint/eslint-plugin": "^6.0.0",
"@typescript-eslint/parser": "^6.0.0"
}

2. Run npm install after updating dependencies.
3. Review .eslintrc.json for correct use of plugin:github/recommended and relevant rules.
4. Run npx eslint . locally to confirm there are no additional errors. If any plugin errors occur, install the missing plugins.

This should resolve the ESLint error and allow CI to pass.

This pull request was created from Copilot chat.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.
• ⚠️ 4 packages with OpenSSF Scorecard issues.

View full job summary

[felickz]

@copilot it still fails build-test https://github.com/advanced-security/codeql-sarif-security-standard-annotator/blob/731f9173009e86a7f7b81afce7aaa48867077fac/.github/workflows/test.yml

Run ./
file:///home/runner/work/codeql-sarif-security-standard-annotator/codeql-sarif-security-standard-annotator/dist/index.js:1
require('./sourcemap-register.js');/******/ (() => { // webpackBootstrap
^

ReferenceError: require is not defined in ES module scope, you can use import instead
    at file:///home/runner/work/codeql-sarif-security-standard-annotator/codeql-sarif-security-standard-annotator/dist/index.js:1:1
    at ModuleJob.run (node:internal/modules/esm/module_job:325:25)
    at async ModuleLoader.import (node:internal/modules/esm/loader:606:24)
    at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:117:5)

Node.js v20.19.5

[Copilot]

@copilot it still fails build-test https://github.com/advanced-security/codeql-sarif-security-standard-annotator/blob/731f9173009e86a7f7b81afce7aaa48867077fac/.github/workflows/test.yml

...

Fixed in commit 5c1aa28. The issue was caused by yargs 18.0.0 being ESM-only and ncc bundling ES module code (import.meta) that's incompatible with CommonJS. Downgraded yargs to 17.7.2 and added "type": "commonjs" to package.json to ensure Node20 loads the action as CommonJS.

[felickz]

I'll be a happy man the day I never see another commonjs issue

[Copilot]

Pull request overview

This PR resolves CI build failures by downgrading ESLint to version 8 to maintain compatibility with the existing .eslintrc.json configuration format, and fixes Node20 ES module compatibility issues by ensuring the action uses CommonJS.

Key changes:

• Downgrade ESLint and related plugins to versions compatible with legacy configuration format
• Downgrade yargs from 18.0.0 to 17.7.2 to avoid ES module-only version incompatible with CommonJS bundling
• Update action.yml to explicitly use Node20 runtime

Reviewed changes

Copilot reviewed 3 out of 6 changed files in this pull request and generated no comments.

File	Description
package.json	Downgrades ESLint from v9 to v8, yargs from v18 to v17, replaces typescript-eslint package with explicit plugin/parser packages, and adds explicit CommonJS type declaration
action.yml	Updates runtime from node16 to node20
.eslintrc.json	Removes deprecated typescript-eslint formatting rules and disables import/no-unresolved rule

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[felickz]

Looks like yargs package causing problems here too